{"id":117926,"date":"2024-07-20T21:43:01","date_gmt":"2024-07-20T19:43:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-http-servera-apache-2-4-62-s-ustraneniem-2-uyazvimostej"},"modified":"2024-07-20T21:43:01","modified_gmt":"2024-07-20T19:43:01","slug":"reliz-http-servera-apache-2-4-62-s-ustraneniem-2-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/reliz-http-servera-apache-2-4-62-s-ustraneniem-2-uyazvimostej","title":{"rendered":"Rilascio del server HTTP Apache 2.4.62 con la correzione di 2 vulnerabilit\u00e0","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00c8 disponibile il rilascio del server HTTP Apache 2.4.62, che risolve due vulnerabilit\u00e0 e introduce 6 modifiche. La prima vulnerabilit\u00e0 (CVE-2024-40898) consente di effettuare un attacco SSRF (Server-side request forgery) su mod_rewrite. Il problema si manifesta solo sulla piattaforma Windows e, inviando richieste opportunamente formattate, pu\u00f2 portare a perdite di hash NTLM su un server controllato dagli aggressori. <\/p>\n

La seconda vulnerabilit\u00e0 (CVE-2024-40725) permette di visualizzare il codice degli script la cui elaborazione \u00e8 configurata tramite la direttiva AddType. Ad esempio, \u00e8 possibile generare una richiesta specificamente formattata a uno script PHP che mostrer\u00e0 il suo contenuto anzich\u00e9 eseguirlo. La correzione blocca un'ulteriore modalit\u00e0 di sfruttamento della vulnerabilit\u00e0 CVE-2024-39884, risolta nella versione 2.4.61. <\/p>\n

Tra le modifiche non relative alla sicurezza, spicca l'aggiunta in mod_ssl della possibilit\u00e0 di caricare certificati e chiavi da archivi che supportano lo standard pkcs11. <\/p>\n

Secondo il rapporto di giugno di Netcraft, circa 212 milioni di siti web sono gestiti dal server HTTP Apache (l'anno scorso erano 228 milioni). La quota di Apache httpd si attesta al 19,28% di tutti i siti, il che significa il secondo posto in questa categoria (quota di Nginx \u2014 21,35%, Cloudflare \u2014 11,05%, OpenResty (piattaforma basata su nginx e LuaJIT) \u2014 0,79%). Considerando solo i siti attivi, Apache si posiziona al primo posto con una quota del 19,13% (quota di Nginx \u2014 18,09%, Cloudflare \u2014 14,80%, Google \u2014 10,01%). Tra i milioni di siti pi\u00f9 visitati al mondo, Apache occupa il terzo posto con una quota del 19,69% (in testa Cloudflare \u2014 23,10% e Nginx \u2014 20,50%).

\"Rilascio<\/center>
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.62, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u0432\u043d\u0435\u0441\u0435\u043d\u043e 6 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439. \u041f\u0435\u0440\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-40898) \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0441\u043e\u0432\u0435\u0440\u0448\u0438\u0442\u044c \u0430\u0442\u0430\u043a\u0443 SSRF (Server-side request forgery) \u043d\u0430 mod_rewrite. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 Windows \u0438 \u043f\u0440\u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0442\u0435\u0447\u043a\u0435 NTLM-\u0445\u044d\u0448\u0435\u0439 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440, \u043f\u043e\u0434\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u044b\u0439 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c. \u0412\u0442\u043e\u0440\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-40725) \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u043a\u043e\u0434 \u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432, \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":117927,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-117926","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Rilascio del server http Apache 2.4.62 con la risoluzione di 2 vulnerabilit\u00e0 | ProHoster","description":"\u00c8 disponibile il rilascio del server HTTP Apache 2.4.62, che risolve due vulnerabilit\u00e0 e include 6 modifiche. La prima vulnerabilit\u00e0 (CVE-2024-40898) consente di eseguire un attacco SSRF (Server-side request forgery) su mod_rewrite. Il problema si manifesta solo sulla piattaforma Windows e, inviando richieste appositamente formattate, pu\u00f2 portare a una fuga di hash NTLM verso un server controllato dagli aggressori. La seconda vulnerabilit\u00e0 (CVE-2024-40725) consente di visualizzare il codice degli script, elaborazione","canonical_url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/reliz-http-servera-apache-2-4-62-s-ustraneniem-2-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.62 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c 2 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u0414\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.62, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u0432\u043d\u0435\u0441\u0435\u043d\u043e 6 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439. \u041f\u0435\u0440\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-40898) \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0441\u043e\u0432\u0435\u0440\u0448\u0438\u0442\u044c \u0430\u0442\u0430\u043a\u0443 SSRF (Server-side request forgery) \u043d\u0430 mod_rewrite. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 Windows \u0438 \u043f\u0440\u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0442\u0435\u0447\u043a\u0435 NTLM-\u0445\u044d\u0448\u0435\u0439 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440, \u043f\u043e\u0434\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u044b\u0439 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c. \u0412\u0442\u043e\u0440\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-40725) \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u043a\u043e\u0434 \u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432, \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0430","og:url":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/reliz-http-servera-apache-2-4-62-s-ustraneniem-2-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-07-20T19:43:01+00:00","article:modified_time":"2024-07-20T19:43:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"117926","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 04:35:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 04:35:19","updated":"2026-01-23 04:35:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/117926","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=117926"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/117926\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media\/117927"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=117926"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=117926"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=117926"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}