{"id":37194,"date":"2019-10-31T22:16:17","date_gmt":"2019-10-31T19:16:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/reliz-http-servera-apache-2-4-41-s-ustraneniem-uyazvimostej\/"},"modified":"2019-10-31T22:16:17","modified_gmt":"2019-10-31T19:16:17","slug":"reliz-http-servera-apache-2-4-41-s-ustraneniem-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/news\/reliz-http-servera-apache-2-4-41-s-ustraneniem-uyazvimostej","title":{"rendered":"Rilascio del server http Apache 2.4.41 con la rimozione delle vulnerabilit\u00e0","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00139.html\">Pubblicato<\/a><\/noindex> rilascio del server HTTP Apache 2.4.41 (il rilascio 2.4.40 \u00e8 stato saltato), che introduce <noindex><a rel=\"nofollow\" href=\"http:\/\/www.apache.org\/dist\/httpd\/CHANGES_2.4.41\">23 modifiche<\/a><\/noindex> e risolve <noindex><a rel=\"nofollow\" href=\"http:\/\/httpd.apache.org\/security\/vulnerabilities_24.html\">6 vulnerabilit\u00e0<\/a><\/noindex>:<\/p>\n<ul>\n<li class=\"l\">  <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00140.html\">CVE-2019-10081<\/a><\/noindex> \u2014 il problema \u00e8 in mod_http2, che pu\u00f2 portare a una corruzione della memoria durante l'invio di richieste push in una fase molto preliminare. Quando si utilizza l'impostazione \u00abH2PushResource\u00bb \u00e8 possibile sovrascrivere la memoria nella pool di gestione delle richieste, ma il problema \u00e8 contenuto, poich\u00e9 i dati scritti non si basano su informazioni ricevute dal cliente;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00145.html\">CVE-2019-9517<\/a><\/noindex> \u2014 vulnerabilit\u00e0 recentemente <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51279\">dell'accordo<\/a><\/noindex> vulnerabilit\u00e0 DoS nelle implementazioni HTTP\/2.<br \/>\nUn attaccante pu\u00f2 esaurire la memoria disponibile per il processo e generare un carico elevato sulla CPU, aprendo una finestra HTTP\/2 scorrevole per inviare dati dal server senza limitazioni, mantenendo al contempo la finestra TCP chiusa, il che impedisce effettivamente di scrivere dati nel socket; <\/p>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00144.html\">CVE-2019-10098<\/a><\/noindex> \u2014 problema in mod_rewrite, che consente di utilizzare il server per reindirizzare le richieste ad altre risorse (open redirect). Alcune impostazioni di mod_rewrite possono portare a reindirizzare l'utente a un altro link, codificato usando un carattere di nuova riga all'interno del parametro utilizzato in un redirect esistente. Per bloccare il problema in RegexDefaultOptions, \u00e8 possibile utilizzare il flag PCRE_DOTALL, che ora \u00e8 impostato di default;\n<li class=\"l\">  <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00142.html\">CVE-2019-10092<\/a><\/noindex> \u2014 possibilit\u00e0 di scripting intersiti nelle pagine di errore emesse da mod_proxy. In queste pagine, il link include l'URL ottenuto dalla richiesta, in cui l'attaccante, tramite la codifica dei caratteri, pu\u00f2 inserire un codice HTML arbitrario;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00143.html\">CVE-2019-10097<\/a><\/noindex> \u2014 overflow dello stack e dereferenziazione di puntatori NULL in mod_remoteip, sfruttati attraverso manipolazioni dell'intestazione del protocollo PROXY. L'attacco pu\u00f2 essere effettuato solo dal lato del server proxy utilizzato nelle impostazioni, e non con la richiesta del cliente;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00141.html\">CVE-2019-10082<\/a><\/noindex> \u2014 vulnerabilit\u00e0 in mod_http2, che consente, al momento della chiusura della connessione, di avviare la lettura del contenuto da un'area di memoria gi\u00e0 liberata (read-after-free).\n<\/ul>\n<p>Le modifiche pi\u00f9 significative non correlate alla sicurezza: <\/p>\n<ul>\n<li class=\"l\"> In mod_proxy_balancer, enhanced protection against XSS\/XSRF attacks from trusted nodes.\n<li class=\"l\"> In mod_session, a SessionExpiryUpdateInterval setting has been added to determine the session\/cookie expiration time update interval.\n<li class=\"l\"> Pages with errors have been cleaned to prevent displaying information from requests on those pages.\n<li class=\"l\"> In mod_http2 \u00e8 stata implementata la considerazione del valore del parametro \u00abLimitRequestFieldSize\u00bb, che in precedenza agiva solo per il controllo dei campi delle intestazioni HTTP\/1.1;\n<li class=\"l\"> Configuration creation for mod_proxy_hcheck is provided when used in BalancerMember.\n<li class=\"l\"> Memory consumption in mod_dav has been reduced when using the PROPFIND command on large collections.\n<li class=\"l\"> Issues with specifying certificate and SSL settings within the Proxy block have been resolved in mod_proxy and mod_ssl.\n<li class=\"l\"> In mod_proxy, the SSLProxyCheckPeer* settings are now allowed for all proxy modules.\n<li class=\"l\"> Le funzionalit\u00e0 del modulo <noindex><a rel=\"nofollow\" href=\"https:\/\/httpd.apache.org\/docs\/2.4\/mod\/mod_md.html\">mod_md<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=47403\">sviluppato<\/a><\/noindex> il progetto Let\u2019s Encrypt per automatizzare il rilascio e la manutenzione dei certificati utilizzando il protocollo ACME (Automatic Certificate Management Environment):\n<ul>\n<li class=\"l\"> A second version of the protocol has been added, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=48255\">ACMEv2<\/a><\/noindex>, which is now applied by default and <noindex><a rel=\"nofollow\" href=\"https:\/\/community.letsencrypt.org\/t\/acme-v2-scheduled-deprecation-of-unauthenticated-resource-gets\/74380\">utilizza<\/a><\/noindex> empty POST requests instead of GET.\n<li class=\"l\"> Aggiunta la supporto per la verifica basata sull'estensione TLS-ALPN-01 (RFC 7301, Application-Layer Protocol Negotiation), utilizzata in HTTP\/2.\n<li class=\"l\"> Supporto terminato per il metodo di verifica \u2018tls-sni-01\u2019 (a causa di <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=47883\">vulnerabilit\u00e0<\/a><\/noindex>).\n<li class=\"l\"> Aggiunti comandi per configurare e interrompere la verifica con il metodo \u2018dns-01\u2019.\n<li class=\"l\"> Aggiunto supporto per <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=46817\">maschere<\/a><\/noindex> nei certificati quando \u00e8 attivata la verifica basata su DNS (\u2018dns-01\u2019).\n<li class=\"l\"> Implementato un gestore \u2018md-status\u2019 e una pagina con lo stato del certificato \u00abhttps:\/\/domain\/.httpd\/certificate-status\u00bb.\n<li class=\"l\">  Aggiunte le direttive \u00abMDCertificateFile\u00bb e \u00abMDCertificateKeyFile\u00bb per configurare i parametri dei domini tramite file statici (senza supporto per l'auto-aggiornamento).\n<li class=\"l\"> \u00c8 stata aggiunta la direttiva \u00abMDMessageCmd\u00bb per richiamare comandi esterni in caso di eventi \u2018renewed\u2019, \u2018expiring\u2019 o \u2018errored\u2019.\n<li class=\"l\"> \u00c8 stata aggiunta la direttiva \u00abMDWarnWindow\u00bb per configurare il messaggio di avviso sulla scadenza del certificato;\n<\/ul>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Fonte: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51298\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.41 (\u0432\u044b\u043f\u0443\u0441\u043a 2.4.40 \u0431\u044b\u043b \u043f\u0440\u043e\u043f\u0443\u0449\u0435\u043d), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e 23 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 6 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2019-10081 &#8212; \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432 mod_http2, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044e \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u0440\u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0435 push-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043d\u0430 \u043e\u0447\u0435\u043d\u044c \u0440\u0430\u043d\u043d\u0435\u0439 \u0441\u0442\u0430\u0434\u0438\u0438. \u041f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 &#171;H2PushResource&#187; \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u0430 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u044c \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u043f\u0430\u043c\u044f\u0442\u0438 \u0432 \u043f\u0443\u043b\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432, \u043d\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0430 \u043a\u0440\u0430\u0445\u043e\u043c, \u0442\u0430\u043a \u043a\u0430\u043a \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u043c\u044b\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37194","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.41 (\u0432\u044b\u043f\u0443\u0441\u043a 2.4.40 \u0431\u044b\u043b \u043f\u0440\u043e\u043f\u0443\u0449\u0435\u043d), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/it\/blog\/news\/reliz-http-servera-apache-2-4-41-s-ustraneniem-uyazvimostej\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"it_IT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.41 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.41 (\u0432\u044b\u043f\u0443\u0441\u043a 2.4.40 \u0431\u044b\u043b \u043f\u0440\u043e\u043f\u0443\u0449\u0435\u043d), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/it\/blog\/news\/reliz-http-servera-apache-2-4-41-s-ustraneniem-uyazvimostej\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:16:17+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:16:17+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Rilascio di Apache HTTP Server 2.4.41 con correzione delle vulnerabilit\u00e0 | ProHoster","description":"\u00c8 stata pubblicata la versione del server HTTP Apache 2.4.41 (la versione 2.4.40 \u00e8 stata saltata), che presenta.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/news\/reliz-http-servera-apache-2-4-41-s-ustraneniem-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.41 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.41 (\u0432\u044b\u043f\u0443\u0441\u043a 2.4.40 \u0431\u044b\u043b \u043f\u0440\u043e\u043f\u0443\u0449\u0435\u043d), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e.","og:url":"https:\/\/prohoster.info\/it\/blog\/news\/reliz-http-servera-apache-2-4-41-s-ustraneniem-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:16:17+00:00","article:modified_time":"2019-10-31T19:16:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37194","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 16:40:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:31:25","updated":"2026-01-23 16:40:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/37194","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=37194"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/37194\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=37194"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=37194"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=37194"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}