Release of the HTTP server Apache 2.4.46 (versions 2.4.44 and 2.4.45 were skipped), which introduces and fixes :
- — a buffer overflow in the mod_proxy_uwsgi module, which may lead to information leakage or code execution on the server when a specially crafted request is sent. The exploitation of the vulnerability is achieved through the transmission of a very long HTTP header. To protect against this, a block of headers longer than 16K has been added (a limit defined in the protocol specification).
- — a vulnerability in the mod_http2 module that allows a crash of the process when sending a request with a specially crafted HTTP/2 header. The issue manifests when debugging or tracing is enabled in the mod_http2 module and is expressed in memory corruption due to a race condition while saving information to the log. The issue does not occur when the LogLevel is set to 'info'.
- — a vulnerability in the mod_http2 module that allows a crash of the process when sending a request with a specially crafted 'Cache-Digest' header value via HTTP/2 (the crash occurs when attempting to perform a HTTP/2 PUSH operation for the resource). To block the vulnerability, the 'H2Push off' setting can be utilized.
- — a vulnerability in mod_remoteip that allows for IP address spoofing when proxying using mod_remoteip and mod_rewrite. The issue only occurs in versions from 2.4.1 to 2.4.23.
The most notable changes not related to security:
- Support for the draft specification has been removed from mod_http2 , which is no longer being promoted.
- The behavior of the 'LimitRequestFields' directive in mod_http2 has changed; specifying a value of 0 now disables the limit.
- In mod_http2, the handling of master and secondary connections has been ensured and methods are marked based on usage.
- In cases of receiving incorrect Last-Modified header content from an FCGI/CGI script, this header is now removed rather than replaced by the epoch time (Unix epoch).
- A function ap_parse_strict_length() has been added to the code for strict parsing of content size.
- In mod_proxy_fcgi, in ProxyFCGISetEnvIf, the removal of environment variables is ensured if the specified expression returns False.
- A race condition and potential crash of mod_ssl when using a client certificate specified via the SSLProxyMachineCertificateFile setting have been eliminated.
- A memory leak in mod_ssl has been resolved.
- The mod_proxy_http2 module now allows the use of the proxy parameter "" when checking the functionality of a new or reused connection to the backend.
- The binding of httpd with the option "-lsystemd" has been discontinued if mod_systemd is enabled.
- The mod_proxy_http2 module now takes the ProxyTimeout setting into account when waiting for incoming data through connections to the backend.
Source: opennet.ru
