ProHoster > Π‘Π»ΠΎΠ³ > xov xwm hauv internet > Apache 2.4.41 http neeg rau zaub mov tso tawm nrog qhov tsis zoo tau kho

Apache 2.4.41 http neeg rau zaub mov tso tawm nrog qhov tsis zoo tau kho

luam tawm tso tawm ntawm Apache HTTP server 2.4.41 (tso tawm 2.4.40 raug hla), uas tau qhia 23 hloov thiab tshem tawm 6 vulnerabilities:

  • CVE-2019-10081 yog ib qho teeb meem hauv mod_http2 uas tuaj yeem ua rau lub cim xeeb kev noj nyiaj txiag thaum xa cov lus thov thawb thaum ntxov. Thaum siv qhov "H2PushResource" teeb tsa, nws muaj peev xwm sau dua lub cim xeeb hauv qhov kev thov ua haujlwm, tab sis qhov teeb meem tsuas yog cuam tshuam vim tias cov ntaub ntawv sau tsis yog raws li cov ntaub ntawv tau txais los ntawm tus neeg siv khoom;
  • CVE-2019-9517 - Kev nthuav tawm tsis ntev los no tshaj tawm DoS vulnerabilities hauv HTTP/2 kev siv.
    Tus neeg tawm tsam tuaj yeem tso lub cim xeeb rau cov txheej txheem thiab tsim lub CPU hnyav los ntawm kev qhib lub qhov rai HTTP / 2 zawv zawg rau cov neeg rau zaub mov xa cov ntaub ntawv yam tsis muaj kev txwv, tab sis khaws TCP qhov rais kaw, tiv thaiv cov ntaub ntawv los ntawm kev sau rau lub qhov (socket);

  • CVE-2019-10098 - ib qho teeb meem hauv mod_rewrite, uas tso cai rau koj siv cov neeg rau zaub mov xa mus rau lwm cov peev txheej (qhib redirect). Qee qhov kev teeb tsa mod_rewrite tuaj yeem ua rau tus neeg siv raug xa mus rau lwm qhov txuas, encoded siv tus cim kab tshiab nyob rau hauv ib qho kev siv nyob rau hauv ib qho redirect uas twb muaj lawm. Txhawm rau thaiv qhov teeb meem hauv RegexDefaultOptions, koj tuaj yeem siv tus chij PCRE_DOTALL, uas tam sim no tau teeb tsa los ntawm lub neej ntawd;
  • CVE-2019-10092 - lub peev xwm los ua qhov sib txawv ntawm qhov chaw sau ntawv ntawm nplooj ntawv yuam kev tshwm sim los ntawm mod_proxy. Ntawm cov nplooj ntawv no, qhov txuas muaj qhov URL tau txais los ntawm qhov kev thov, uas tus neeg tawm tsam tuaj yeem tso cai HTML code los ntawm tus cwj pwm khiav tawm;
  • CVE-2019-10097 - pawg overflow thiab NULL pointer dereference nyob rau hauv mod_remoteip, exploited los ntawm manipulation ntawm PROXY raws tu qauv header. Qhov kev tawm tsam tuaj yeem tsuas yog nqa tawm los ntawm sab ntawm lub npe neeg rau zaub mov siv hauv qhov chaw, thiab tsis yog los ntawm tus neeg thov kev thov;
  • CVE-2019-10082 - qhov tsis zoo nyob rau hauv mod_http2 uas tso cai rau, thaum lub sijhawm ntawm kev sib txuas txiav, pib nyeem cov ntsiab lus los ntawm qhov chaw nco tau tso tawm (nyeem-tom qab-dawb).

Qhov tseem ceeb tshaj plaws kev hloov pauv tsis muaj kev ruaj ntseg yog:

  • mod_proxy_balancer tau txhim kho kev tiv thaiv XSS/XSRF tawm tsam los ntawm cov phooj ywg ntseeg siab;
  • Ib qho SessionExpiryUpdateInterval qhov chaw tau ntxiv rau mod_session los txiav txim lub caij nyoog rau kev hloov kho lub sijhawm sib kho / ncuav qab zib tas sij hawm;
  • Cov nplooj ntawv uas tsis raug raug ntxuav, txhawm rau tshem tawm cov ntaub ntawv los ntawm kev thov ntawm nplooj ntawv no;
  • mod_http2 coj mus rau hauv tus account tus nqi ntawm "LimitRequestFieldSize" parameter, uas yav tas los tsuas siv tau rau kev tshuaj xyuas HTTP/1.1 header teb;
  • Xyuas kom meej tias mod_proxy_hcheck configuration yog tsim thaum siv nyob rau hauv BalancerMember;
  • Txo kev nco noj hauv mod_dav thaum siv PROPFIND hais kom ua ntawm kev sau loj;
  • Hauv mod_proxy thiab mod_ssl, teeb meem nrog kev qhia ntawv pov thawj thiab SSL teeb tsa hauv Proxy thaiv tau raug daws;
  • mod_proxy tso cai rau SSLProxyCheckPeer* nqis los siv rau txhua tus proxy modules;
  • Module muaj peev xwm nthuav dav mod_md, tsim tawm Cia's Encrypt qhov project los ua kom tau txais daim ntawv lees paub thiab kev saib xyuas cov ntawv pov thawj siv ACME (Automatic Certificate Management Environment) raws tu qauv:
    • Ntxiv thib ob version ntawm tus txheej txheem ACMEv 2, uas yog tam sim no lub neej ntawd thiab siv npliag POST thov es tsis txhob GET.
    • Ntxiv kev txhawb nqa rau kev txheeb xyuas raws li TLS-ALPN-01 txuas ntxiv (RFC 7301, Application-Layer Protocol Negotiation), uas yog siv hauv HTTP/2.
    • Kev them nyiaj yug rau 'tls-sni-01' txoj kev pov thawj tau raug txiav tawm (vim yog yooj yim).
    • Ntxiv cov lus txib rau kev teeb tsa thiab rhuav tshem daim tshev siv 'dns-01' txoj kev.
    • Ntxiv kev txhawb nqa daim npog qhov ncauj nyob rau hauv daim ntawv pov thawj thaum DNS-raws li kev txheeb xyuas tau qhib ('dns-01').
    • Siv 'md-status' handler thiab daim ntawv pov thawj nplooj ntawv 'https://domain/.httpd/certificate-status'.
    • Ntxiv "MDCertificateFile" thiab "MDCertificateKeyFile" cov lus qhia rau kev teeb tsa cov kev txwv tsis pub dhau los ntawm cov ntaub ntawv zoo li qub (tsis muaj kev txhawb nqa hloov tshiab).
    • Ntxiv "MDMessageCmd" cov lus qhia kom hu rau lwm cov lus txib thaum 'hloov tshiab', ' tas sij hawm' lossis ' yuam kev' tshwm sim.
    • Ntxiv "MDWarnWindow" cov lus qhia los teeb tsa cov lus ceeb toom txog daim ntawv pov thawj tas sij hawm;

Tau qhov twg los: opennet.ru

Ntxiv ib saib