{"id":111027,"date":"2023-10-22T03:10:14","date_gmt":"2023-10-22T01:10:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-http-servera-apache-2-4-58-s-ustraneniem-dos-uyazvimostej-v-http-2"},"modified":"2023-10-22T03:10:14","modified_gmt":"2023-10-22T01:10:14","slug":"reliz-http-servera-apache-2-4-58-s-ustraneniem-dos-uyazvimostej-v-http-2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/reliz-http-servera-apache-2-4-58-s-ustraneniem-dos-uyazvimostej-v-http-2","title":{"rendered":"Release of the Apache HTTP server 2.4.58 with fixes for DoS vulnerabilities in HTTP\/2","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The release of Apache HTTP Server 2.4.58 has been published, featuring 33 changes and addressing three vulnerabilities, two of which are related to the potential for DoS attacks on systems using the HTTP\/2 protocol. <\/p>\n
\n
CVE-2023-45802 \u2014 creates conditions for exhausting free memory due to delayed memory release after an HTTP\/2 stream reset with an RST flag. Since memory is not released immediately after processing the RST flag, but only after the connection is closed, an attacker can significantly increase memory usage by sending new requests and resetting them with an RST packet without closing the connection.\n
CVE-2023-43622 \u2014 infinite blocking of HTTP\/2 connection processing if it was opened with an initial sliding window size set to 0. This vulnerability can be exploited to create a denial-of-service condition by exhausting the limit on the maximum number of open connections.\n
CVE-2023-31122 \u2014 a vulnerability in mod_macro that leads to reading data from outside the allocated buffer. <\/ul>\n
Among the changes unrelated to security: <\/p>\n
\n
Support for using the WebSocket protocol over the stream in HTTP\/2 connections (RFC 8441) has been added to mod_http2. The directive 'H2WebSockets on|off' has been proposed to enable WebSocket over HTTP\/2.\n
The 'H2EarlyHint name value' directive has been added to mod_http2 for adding headers to the '103 Early Hints' response.\n
The 'H2ProxyRequests on|off' directive has been added to mod_http2 to control enabling HTTP\/2 request processing in proxy configuration.\n
The 'H2MaxDataFrameLen n' directive has been added to mod_http2 to limit the maximum size of the response body in bytes transmitted in a single DATA frame in HTTP\/2. By default, the limit is set to 16KB.\n
The mime.types file has been updated, where the '.js' extension is associated with the type 'text\/javascript' instead of 'application\/javascript', and the extensions '.mjs' (with the type 'text\/javascript') and '.opus' ('audio\/ogg') have been added. MIME types and extensions used in WebAssembly have also been added.\n
The mod_tls module (an alternative to mod_ssl implemented in Rust) has been transitioned to use the rustls-ffi library version 0.9.2+.\n
The 'MDMatchNames all|servernames' directive has been added to the mod_md module to manage matching MDomains with the contents of VirtualHosts.\n
The 'MDChallengeDns01Version' directive has been added to the mod_md module to select the version of the ACME protocol used for DNS verification.\n
The use of the MDChallengeDns01 directive for individual... domains<\/a>.\n