release of Apache HTTP Server 2.4.43 (release 2.4.42 was skipped), which includes and fixes :
- CVE-2020-1927: vulnerability in mod_rewrite allowing the server to redirect requests to other resources (open redirect). Some mod_rewrite settings may lead to a user being redirected to another link, encoded with a newline character within the parameter used in an existing redirect.
- CVE-2020-1934: vulnerability in mod_proxy_ftp. The use of uninitialized values can lead to leaking memory content when proxying requests to an FTP server controlled by an attacker.
- Memory leak in mod_ssl occurring during the stapling of OCSP requests.
The most notable changes not related to security:
- New module added , providing integration with the system manager systemd. This module allows httpd to be used in services of type 'Type=notify'.
- Support for cross-compilation has been added to apxs.
- The capabilities of mod_md, developed by the Let’s Encrypt project to automate the acquisition and management of certificates using the ACME (Automatic Certificate Management Environment) protocol, have been expanded:
- A new directive MDContactEmail has been added, which allows specifying a contact email that does not overlap with the data from the ServerAdmin directive.
- For all virtual hosts, support for the protocol used in negotiating a secure communication channel ('tls-alpn-01') has been ensured.
- The use of mod_md directives in and blocks has been allowed.
- Past configurations are replaced when reusing MDCAChallenges.
- The ability to configure url for CTLog Monitor has been added.
- For certain commands specified in the MDMessageCmd directive, a call with the argument 'installed' is ensured when activating a new certificate after server restart (for example, it can be used to copy or transform the new certificate for other applications).
- mod_proxy_hcheck has added support for the mask %{Content-Type} in check expressions.
- In mod_usertrack, CookieSameSite, CookieHTTPOnly, and CookieSecure modes have been added for configuring the handling of usertrack cookies.
- In mod_proxy_ajp, the 'secret' parameter for proxy handlers has been implemented to support the deprecated AJP13 authentication protocol.
- A configuration set for OpenWRT has been added.
- Support for using private keys and certificates from OpenSSL ENGINE has been added to mod_ssl by specifying the PKCS#11 URI in SSLCertificateFile/KeyFile.
- Testing has been implemented using the Travis CI continuous integration system.
- The parsing of Transfer-Encoding headers has been tightened.
- Mod_ssl now provides TLS protocol negotiation bound to virtual hosts (supported when compiled with OpenSSL-1.1.1+).
- Thanks to the use of hashing for command tables, the graceful restart (without interrupting ongoing request handlers) has been accelerated.
- Mod_lua has added the tables r:headers_in_table, r:headers_out_table, r:err_headers_out_table, r:notes_table, and r:subprocess_env_table, available in read-only mode. Tables can now be assigned a value of 'nil'.
- The limit on the size of the cacheable string in mod_authn_socache has increased from 100 to 256.
Source: opennet.ru
