{"id":102701,"date":"2021-12-22T09:36:38","date_gmt":"2021-12-22T07:36:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-http-servera-apache-2-4-52-s-ustraneniem-perepolneniya-bufera-v-mod_lua"},"modified":"2021-12-22T09:36:38","modified_gmt":"2021-12-22T07:36:38","slug":"reliz-http-servera-apache-2-4-52-s-ustraneniem-perepolneniya-bufera-v-mod_lua","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/reliz-http-servera-apache-2-4-52-s-ustraneniem-perepolneniya-bufera-v-mod_lua","title":{"rendered":"Izdanje http poslu\u017eitelja Apache 2.4.52 s ispravkom preljevanja bafera u mod_lua","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Objavljen je HTTP server Apache 2.4.52, koji uklju\u010duje 25 promjena i ispravlja 2 ranjivosti:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2021-44790 \u2014 prelivanje bafera u mod_lua, koje se manifestira prilikom analize vi\u0161edijelnih (multipart) zahtjeva. Ranljivost utje\u010de na konfiguracije u kojima Lua skripte pozivaju funkciju r:parsebody() za analizu tijela zahtjeva, i omogu\u0107uje napada\u010du da izazove prelivanje bafera slanjem posebno oblikovanog zahtjeva. Do sada nisu otkrivene \u010dinjenice o postojanju eksploita, no potencijalno ta problematika mo\u017ee dovesti do izvr\u0161avanja vlastitog koda na <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/hr\/server\/dts-newyork\/\"   title=\"serveru\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2693\">serveru<\/a>.\n<li class=\"l\"> CVE-2021-44224 \u2014 SSRF ranjivost (Server Side Request Forgery) u mod_proxy, koja omogu\u0107ava u konfiguracijama s postavkom \u00abProxyRequests on\u00bb da se putem zahtjeva posebno oblikovanog URI-ja postigne preusmjeravanje zahtjeva na drugi obrtnik na istom poslu\u017eitelju, koji prihva\u0107a veze putem Unix Domain Socketa. Problem se tako\u0111er mo\u017ee iskoristiti za izazivanje ru\u0161enja putem stvaranja uvjeta za dereferenciranje nul pokaziva\u010da. Ova ranjivost utje\u010de na verzije Apache httpd od verzije 2.4.7.    <\/ul>\n<p>Najistaknutije promjene, koje nisu vezane uz sigurnost:   <\/p>\n<ul>\n<li class=\"l\"> U mod_ssl dodana je podr\u0161ka za gradnju s OpenSSL 3 bibliotekom.\n<li class=\"l\"> Pobolj\u0161ano je odre\u0111ivanje OpenSSL biblioteke u autoconf skriptama.\n<li class=\"l\"> U mod_proxy za protokole tuneliranja pru\u017eena je mogu\u0107nost isklju\u010divanja preusmjeravanja poluotvorenih (half-close) TCP veza postavljanjem parametra \u00abSetEnv proxy-nohalfclose\u00bb.\n<li class=\"l\"> Dodane su dodatne provjere da URI koji nije namijenjen za proksiranje sadr\u017ei http\/https shemu, dok oni namijenjeni za proksiranje sadr\u017ee naziv hosta.\n<li class=\"l\"> U mod_proxy_connect i mod_proxy zabranjeno je mijenjanje koda stanja nakon \u0161to je poslat klijentu.\n<li class=\"l\"> Prilikom slanja me\u0111urezultata nakon primanja zahtjeva s zaglavljem \u00abExpect: 100-Continue\u00bb osigurano je navo\u0111enje u rezultatu stanja \u00ab100 Continue\u00bb, a ne trenuta\u010dnog stanja zahtjeva.\n<li class=\"l\"> U mod_dav dodana je podr\u0161ka za CalDAV ekstenzije, u kojima prilikom generisanja svojstva treba uzeti u obzir i elemente dokumenta i elemente svojstva. Dodate su nove funkcije dav_validate_root_ns(), dav_find_child_ns(), dav_find_next_ns(), dav_find_attr_ns() i dav_find_attr(), koje se mogu pozivati iz drugih modula.\n<li class=\"l\"> U mpm_event rije\u0161en je problem sa zaustavljanjem neaktivnih podprocesa nakon naglog porasta optere\u0107enja na serveru.\n<li class=\"l\"> U mod_http2 ispravljene su regressive promjene koje dovode do neispravnog pona\u0161anja prilikom obrade ograni\u010denja MaxRequestsPerChild i MaxConnectionsPerChild.\n<li class=\"l\"> Pro\u0161irene mogu\u0107nosti modula mod_md, koji se koristi za automatizaciju dobijanja i odr\u017eavanja certifikata uz pomo\u0107 ACME protokola (Automatic Certificate Management Environment):\n<ul>\n<li class=\"l\"> Dodana podr\u0161ka za ACME External Account Binding (EAB) mehanizam, koji se aktivira putem direktive MDExternalAccountBinding. Vrijednosti za EAB mogu se pode\u0161avati iz vanjske datoteke u JSON formatu, \u0161to omogu\u0107ava da se podaci za autentifikaciju ne otkrivaju u glavnoj datoteci. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/hr\/server\/\"   title=\"konfiguracije servera\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"997\">konfiguracije servera<\/a>.\n<li class=\"l\"> U direktivi \u2018MDCertificateAuthority\u2019 osigurana je provjera navo\u0111enja u parametru URL http\/https ili jednog od unaprijed definiranih imena (\u2018LetsEncrypt\u2019, \u2018LetsEncrypt-Test\u2019, \u2018Buypass\u2019 i \u2018Buypass-Test\u2019).\n<li class=\"l\">  Dozvoljeno je kori\u0161\u0107enje direktive MDContactEmail unutar sekcije .\n<li class=\"l\"> Ispravljeno je vi\u0161e gre\u0161aka, uklju\u010duju\u0107i re\u0161avanje curenja memorije koje se javlja u slu\u010daju neuspeha pri u\u010ditavanju privatnog klju\u010da.  <\/ul>\n<\/ul>\n<p>Izvor: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=56387\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.52, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e 25 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b 2 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: CVE-2021-44790 &#8212; \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 mod_lua, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0435\u0435\u0441\u044f \u043f\u0440\u0438 \u0440\u0430\u0437\u0431\u043e\u0440\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432, \u0441\u043e\u0441\u0442\u043e\u044f\u0449\u0438\u0445 \u0438\u0437 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0447\u0430\u0441\u0442\u0435\u0439 (multipart). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 Lua-\u0441\u043a\u0440\u0438\u043f\u0442\u044b \u0432\u044b\u0437\u044b\u0432\u0430\u044e\u0442 \u0444\u0443\u043d\u043a\u0446\u0438\u044e r:parsebody() \u0434\u043b\u044f \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0442\u0435\u043b\u0430 \u0437\u0430\u043f\u0440\u043e\u0441\u0430, \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430. \u0424\u0430\u043a\u0442\u043e\u0432 \u043d\u0430\u043b\u0438\u0447\u0438\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102701","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.52, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e 25 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b 2 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: CVE-2021-44790 - \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 mod_lua, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0435\u0435\u0441\u044f \u043f\u0440\u0438 \u0440\u0430\u0437\u0431\u043e\u0440\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/hr\/blog\/news\/reliz-http-servera-apache-2-4-52-s-ustraneniem-perepolneniya-bufera-v-mod_lua\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"hr_HR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.52 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 mod_lua | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.52, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e 25 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b 2 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: CVE-2021-44790 - \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 mod_lua, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0435\u0435\u0441\u044f \u043f\u0440\u0438 \u0440\u0430\u0437\u0431\u043e\u0440\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/hr\/blog\/news\/reliz-http-servera-apache-2-4-52-s-ustraneniem-perepolneniya-bufera-v-mod_lua\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-12-22T07:36:38+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-12-22T07:36:38+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Izdanje HTTP servera Apache 2.4.52 sa re\u0161enim prelivanjem bafera u mod_lua | ProHoster","description":"Objavljen je HTTP server Apache 2.4.52, koji sadr\u017ei 25 promena i re\u0161ava 2 ranjivosti: CVE-2021-44790 - prelivanje bafera u mod_lua, koje se manifestuje prilikom analize zahteva.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/reliz-http-servera-apache-2-4-52-s-ustraneniem-perepolneniya-bufera-v-mod_lua","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.52 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 mod_lua | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.52, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e 25 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b 2 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: CVE-2021-44790 - \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 mod_lua, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0435\u0435\u0441\u044f \u043f\u0440\u0438 \u0440\u0430\u0437\u0431\u043e\u0440\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/reliz-http-servera-apache-2-4-52-s-ustraneniem-perepolneniya-bufera-v-mod_lua","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-12-22T07:36:38+00:00","article:modified_time":"2021-12-22T07:36:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102701","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-12-22 07:36:51","updated":"2026-02-09 21:39:49","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/102701","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=102701"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/102701\/revisions"}],"predecessor-version":[{"id":159973,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/102701\/revisions\/159973"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=102701"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=102701"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=102701"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}