{"id":104356,"date":"2022-06-11T15:36:47","date_gmt":"2022-06-11T13:36:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-http-servera-apache-2-4-54-s-ustraneniem-uyazvimostej"},"modified":"2022-06-11T15:36:47","modified_gmt":"2022-06-11T13:36:47","slug":"reliz-http-servera-apache-2-4-54-s-ustraneniem-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/reliz-http-servera-apache-2-4-54-s-ustraneniem-uyazvimostej","title":{"rendered":"Sortie du serveur HTTP Apache 2.4.54 avec correction des vuln\u00e9rabilit\u00e9s","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>La version du serveur HTTP Apache 2.4.53 a \u00e9t\u00e9 publi\u00e9e, introduisant 19 modifications et corrigeant 8 vuln\u00e9rabilit\u00e9s :  <\/p>\n<ul>\n<li class=\"l\"> CVE-2022-31813 \u2014 vuln\u00e9rabilit\u00e9 dans mod_proxy, permettant de bloquer l'envoi des en-t\u00eates X-Forwarded-* contenant des informations sur l'adresse IP d'origine de la requ\u00eate. Ce probl\u00e8me peut \u00eatre utilis\u00e9 pour contourner les restrictions d'acc\u00e8s bas\u00e9es sur les adresses IP.\n<li class=\"l\"> CVE-2022-30556 \u2014 vuln\u00e9rabilit\u00e9 dans mod_lua, permettant d'acc\u00e9der \u00e0 des donn\u00e9es en dehors du tampon allou\u00e9 par la manipulation de la fonction r:wsread() dans des scripts Lua.\n<li class=\"l\"> CVE-2022-30522 \u2014 d\u00e9ni de service (\u00e9puisement de la m\u00e9moire disponible) lors du traitement de certaines donn\u00e9es par le module mod_sed.\n<li class=\"l\"> CVE-2022-29404 \u2014 d\u00e9ni de service dans mod_lua, exploit\u00e9 par l'envoi de requ\u00eates sp\u00e9cialement format\u00e9es aux gestionnaires Lua utilisant l'appel r:parsebody(0).\n<li class=\"l\"> CVE-2022-28615, CVE-2022-28614 \u2014 d\u00e9ni de service ou acc\u00e8s \u00e0 des donn\u00e9es dans la m\u00e9moire du processus en raison d'erreurs dans les fonctions ap_strcmp_match() et ap_rwrite(), conduisant \u00e0 des lectures en dehors de la zone tampon.\n<li class=\"l\"> CVE-2022-28330 \u2014 fuite d'informations \u00e0 partir de zones en dehors des limites du tampon dans mod_isapi (probl\u00e8me se manifestant uniquement sur la plateforme Windows).\n<li class=\"l\"> CVE-2022-26377 \u2014 le module mod_proxy_ajp est vuln\u00e9rable \u00e0 des attaques de type \u00ab HTTP Request Smuggling \u00bb sur des syst\u00e8mes frontend-backend, permettant d'injecter du contenu dans les requ\u00eates d'autres utilisateurs trait\u00e9es dans le m\u00eame flux entre le frontend et le backend.         <\/ul>\n<p>Les modifications les plus remarquables, non li\u00e9es \u00e0 la s\u00e9curit\u00e9 :   <\/p>\n<ul>\n<li class=\"l\"> La compatibilit\u00e9 du mode SSLFIPS avec OpenSSL 3.0 a \u00e9t\u00e9 assur\u00e9e dans mod_ssl.\n<li class=\"l\"> Le support de TLSv1.3 a \u00e9t\u00e9 ajout\u00e9 \u00e0 l'outil ab (n\u00e9cessite le lien avec <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/fr\/ssl-sertifikat\/\"   title=\"SSL\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2306\">SSL<\/a>-une biblioth\u00e8que qui prend en charge ce protocole).\n<li class=\"l\"> Dans mod_md, la directive MDCertificateAuthority permet l'utilisation de plusieurs noms et URL d'autorit\u00e9 de certification. De nouvelles directives ont \u00e9t\u00e9 ajout\u00e9es : MDRetryDelay (d\u00e9finit le d\u00e9lai avant l'envoi d'une nouvelle demande) et MDRetryFailover (d\u00e9finit le nombre de tentatives en cas d'\u00e9chec avant de choisir une autorit\u00e9 de certification alternative). Un support pour l'\u00e9tat \u00ab auto \u00bb a \u00e9t\u00e9 ajout\u00e9 lors de la sortie des valeurs au format \u00ab key: value \u00bb. La gestion des certificats pour les utilisateurs de la protection a \u00e9t\u00e9 am\u00e9lior\u00e9e. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/fr\/vpn\/\"   title=\"VPN\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"217\">VPN<\/a>-r\u00e9seaux Tailscale.\n<li class=\"l\"> Le module mod_http2 a \u00e9t\u00e9 nettoy\u00e9 de son code inutilis\u00e9 et non s\u00e9curis\u00e9.\n<li class=\"l\"> Dans mod_proxy, le port r\u00e9seau du back-end est r\u00e9percut\u00e9 dans les messages d'erreur enregistr\u00e9s dans les logs.\n<li class=\"l\"> Dans mod_heartmonitor, la valeur du param\u00e8tre HeartbeatMaxServers a \u00e9t\u00e9 modifi\u00e9e de 0 \u00e0 10 (initialisation de 10 emplacements de m\u00e9moire partag\u00e9e).    <\/ul>\n<p>Source : <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=57334\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.53, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e 19 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 8 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2022-31813 &#8212; \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 mod_proxy, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432 X-Forwarded-* \u0441 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0435\u0439 \u043e\u0431 IP-\u0430\u0434\u0440\u0435\u0441\u0435, \u0441 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043f\u043e\u0441\u0442\u0443\u043f\u0438\u043b \u0438\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0445 \u0437\u0430\u043f\u0440\u043e\u0441. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0439 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043f\u043e IP-\u0430\u0434\u0440\u0435\u0441\u0430\u043c. CVE-2022-30556 &#8212; \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 mod_lua, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0434\u0430\u043d\u043d\u044b\u043c \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u0430\u043c\u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-104356","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.53, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e 19 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 8 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2022-31813 - \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 mod_proxy, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/fr\/blog\/news\/reliz-http-servera-apache-2-4-54-s-ustraneniem-uyazvimostej\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"fr_FR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.54 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.53, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e 19 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 8 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2022-31813 - \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 mod_proxy, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/fr\/blog\/news\/reliz-http-servera-apache-2-4-54-s-ustraneniem-uyazvimostej\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2022-06-11T13:36:47+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2022-06-11T13:36:47+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47 La version 2.4.54 du serveur HTTP Apache corrige des vuln\u00e9rabilit\u00e9s | ProHoster","description":"La version 2.4.53 du serveur HTTP Apache a \u00e9t\u00e9 publi\u00e9e, introduisant 19 modifications et corrigeant 8 vuln\u00e9rabilit\u00e9s : CVE-2022-31813 - une vuln\u00e9rabilit\u00e9 dans mod_proxy qui permet de bloquer l'envoi d'en-t\u00eates.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/reliz-http-servera-apache-2-4-54-s-ustraneniem-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.54 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.53, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e 19 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 8 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2022-31813 - \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 mod_proxy, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/reliz-http-servera-apache-2-4-54-s-ustraneniem-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-06-11T13:36:47+00:00","article:modified_time":"2022-06-11T13:36:47+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"104356","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 18:16:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-06-11 13:37:51","updated":"2026-02-09 18:16:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/104356","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=104356"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/104356\/revisions"}],"predecessor-version":[{"id":159551,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/104356\/revisions\/159551"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=104356"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=104356"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=104356"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}