The release of the lightweight HTTP server lighttpd 1.4.76 has been published, focused on combining high performance, security, standard compliance, and configurability. Lighttpd is suitable for use in high-load systems and aims for low memory and CPU resource consumption. The project code is written in C and distributed under the BSD license.
In the new version:
- Detection of the 'Continuation flood' attack, carried out by sending an uninterrupted stream of CONTINUATION frames over HTTP/2 without setting the END_HEADERS flag, has been ensured. It is claimed that this attack does not lead to denial of service for lighttpd, but detection has been added as an additional measure, along with sending a GO_AWAY response. server An incident involving a backdoor in the xz package has been taken into account. When creating releases for dependency builds, code is now obtained from Git using the 'git archive' command with verification by release tags and without downloading pre-packaged archives of the code.
- By default, a built-in file mimetype.assign is provided.
- Support for the MPTCP (MultiPath TCP) extension has been added, which is not enabled by default.
- Improved support for GNU/Hurd and NetBSD 10 platforms.
- The number of system calls made when connecting to the backend has been reduced.
- Future releases are planned to set TLSv1.3 as the minimum supported default version of the TLS protocol (currently the MinProtocol parameter is set to TLSv1.2). In the future, the server.error-handler-404 handler will be limited to handling only 404 errors (currently it handles both 404 and 403).
- Also noteworthy is the release of the Apache HTTP server 2.4.59, which includes 21 changes and addresses three vulnerabilities:
CVE-2024-27316 — a vulnerability leading to memory exhaustion when carrying out a 'Continuation flood' attack.
- CVE-2024-24795, CVE-2023-38709 — the possibility of carrying out an attack by splitting HTTP responses on frontend-backend systems, allowing additional response headers to be injected or responses to be fragmented to interfere with content for other users processed in the same thread between the frontend and backend.
- A CGIScriptTimeout parameter has been added to the mod_cgi module to set the script execution timeout.
- In mod_xml2enc, compatibility with libxml2 2.12.0 and newer releases has been ensured.
- In mod_xml2enc, compatibility with libxml2 2.12.0 and newer releases has been ensured.
- In mod_ssl, standard OpenSSL functions are used to assemble lists of certificate authority names when processing the SSLCACertificatePath and SSLCADNRequestPath directives.
- In mod_xml2enc, XML handling is provided for any text/* MIME types and XML to prevent data corruption in Microsoft OOXML formats.
- In the htcacheclean utility, options -a/-A now iterate through all files in each subdirectory.
- In mod_ssl, the SSLProxyMachineCertificateFile/Path directives now allow referencing files containing certificate authority certificates.
- The documentation for the htpasswd, htdbm, and dbmmanage utilities clarifies that they use hashing rather than encryption for passwords.
- In htpasswd, support for processing password hashes using the SHA-2 algorithm has been added.
- In mod_env, overriding of system environment variables is now permitted.
- In mod_ldap, HTML data escaping has been implemented in the ldap-status header.
- In mod_ssl, compatibility with OpenSSL 3 has been improved, and memory release back to the system has been ensured.
- In mod_proxy, TTL setting for the DNS response cache record lifetime has been allowed.
- In mod_proxy, support for a third argument has been added to the ProxyRemote parameter, allowing configuration of credentials passed to the external proxy for Basic authentication.
Source: opennet.ru
