The release of Apache HTTP Server 2.4.48 has been published (release 2.4.47 was skipped), featuring 39 changes and fixing 8 vulnerabilities:
- CVE-2021-30641 — incorrect triggering of the section with 'MergeSlashes OFF' mode;
- CVE-2020-35452 — stack overflow due to a single null byte in mod_auth_digest;
- CVE-2021-31618, CVE-2020-26691, CVE-2020-26690, CVE-2020-13950 — dereferencing of NULL pointers in mod_http2, mod_session, and mod_proxy_http;
- CVE-2020-13938 — possible denial of service for the httpd process by an unprivileged user in Windows;
- CVE-2019-17567 — protocol negotiation issues in mod_proxy_wstunnel and mod_proxy_http.
The most notable changes not related to security:
- A setting ProxyWebsocketFallbackToProxyHttp has been added to mod_proxy_wstunnel to disable switching to mod_proxy_http for WebSocket.
- Related functions have been included in the main server API, SSL which are now available without the mod_ssl module (for example, allowing mod_md to provide keys and certificates).
- OCSP (Online Certificate Status Protocol) response processing has been moved from mod_ssl/mod_md to the core, allowing other modules to access OCSP data and generate OCSP responses.
- Wildcard usage in the MDomains directive is allowed in mod_md, for example, 'MDomain *.host.net'. Different types of keys can be specified in the MDPrivateKeys directive, such as 'MDPrivateKeys secp384r1 rsa2048' allowing the use of ECDSA and RSA certificates. Support for the deprecated ACMEv1 protocol has been provided.
- Support for Lua 5.4 has been added in mod_lua.
- The version of the mod_http2 module has been updated. Error handling has been improved. An option 'H2OutputBuffering on/off' has been added to control output buffering (enabled by default).
- In mod_dav, the 'Digest' mode has been implemented for the FileETag directive to generate ETags based on a hash of the file content.
- In mod_proxy, restriction of ProxyErrorOverride application by specific status codes has been allowed.
- New directives ReadBufferSize, FlushMaxThreshold, and FlushMaxPipelined have been implemented.
- In mod_rewrite, handling of the SameSite attribute when parsing the [CO] (cookie) flag in the RewriteRule directive has been implemented.
- A check_trans hook has been added to mod_proxy to reject requests at an early stage.
Source: opennet.ru
