{"id":37194,"date":"2019-10-31T22:16:17","date_gmt":"2019-10-31T19:16:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/reliz-http-servera-apache-2-4-41-s-ustraneniem-uyazvimostej\/"},"modified":"2019-10-31T22:16:17","modified_gmt":"2019-10-31T19:16:17","slug":"reliz-http-servera-apache-2-4-41-s-ustraneniem-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/news\/reliz-http-servera-apache-2-4-41-s-ustraneniem-uyazvimostej","title":{"rendered":"Rilascio del server http Apache 2.4.41 con correzioni di vulnerabilit\u00e0","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00139.html\">Pubblicato<\/a><\/noindex> rilascio del server HTTP Apache 2.4.41 (la versione 2.4.40 \u00e8 stata saltata), che presenta <noindex><a rel=\"nofollow\" href=\"http:\/\/www.apache.org\/dist\/httpd\/CHANGES_2.4.41\">23 modifiche<\/a><\/noindex> e risolve <noindex><a rel=\"nofollow\" href=\"http:\/\/httpd.apache.org\/security\/vulnerabilities_24.html\">6 vulnerabilit\u00e0<\/a><\/noindex>:<\/p>\n<ul>\n<li class=\"l\">  <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00140.html\">CVE-2019-10081<\/a><\/noindex> \u2014 c'\u00e8 un problema in mod_http2, che pu\u00f2 portare a un danneggiamento della memoria durante l'invio di richieste push in una fase iniziale. Utilizzando l'impostazione \u00abH2PushResource\u00bb \u00e8 possibile sovrascrivere un'area di memoria nel pool di elaborazione delle richieste, ma il problema \u00e8 limitato a un crash, poich\u00e9 i dati scritti non si basano su informazioni ricevute dal client;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00145.html\">CVE-2019-9517<\/a><\/noindex> \u2014 vulnerabilit\u00e0 recentemente <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51279\">annunciata<\/a><\/noindex> vulnerabilit\u00e0 DoS nelle implementazioni HTTP\/2.<br \/>\nUn attaccante pu\u00f2 esaurire la memoria disponibile per il processo e creare un carico elevato sulla CPU, aprendo una finestra HTTP\/2 per inviare dati dal server senza restrizioni, ma mantenendo chiusa la finestra TCP, il che non consente di scrivere effettivamente i dati nel socket; <\/p>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00144.html\">CVE-2019-10098<\/a><\/noindex> \u2014 c'\u00e8 un problema in mod_rewrite, che consente di utilizzare il server per inoltrare richieste ad altre risorse (open redirect). Alcune impostazioni di mod_rewrite possono portare a reindirizzare l'utente a un altro link, codificato con un carattere di nuova linea all'interno del parametro usato in un reindirizzamento esistente. Per bloccare il problema, nel RegexDefaultOptions si pu\u00f2 utilizzare il flag PCRE_DOTALL, ora impostato di default;\n<li class=\"l\">  <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00142.html\">CVE-2019-10092<\/a><\/noindex> \u2014 possibilit\u00e0 di attacchi di scripting intersiti nelle pagine di errore generate da mod_proxy. In queste pagine, il link incorpora l'URL ricevuto dalla richiesta, il quale pu\u00f2 essere manipolato dall'attaccante tramite l'escaping dei caratteri per inserire codice HTML arbitrario;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00143.html\">CVE-2019-10097<\/a><\/noindex> \u2014 overflow dello stack e dereferenziazione di un puntatore NULL in mod_remoteip, sfruttato attraverso manipolazioni dell'intestazione del protocollo PROXY. L'attacco pu\u00f2 essere effettuato solo dal lato della configurazione del server proxy, e non attraverso una richiesta del client;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00141.html\">CVE-2019-10082<\/a><\/noindex> \u2014 vulnerabilit\u00e0 in mod_http2, che consente di avviare la lettura del contenuto da un'area di memoria gi\u00e0 liberata (read-after-free) al termine della connessione.\n<\/ul>\n<p>Le modifiche pi\u00f9 significative non correlate alla sicurezza: <\/p>\n<ul>\n<li class=\"l\"> In mod_proxy_balancer \u00e8 stata potenziata la protezione contro gli attacchi XSS\/XSRF da parte di nodi attendibili;\n<li class=\"l\"> In mod_session \u00e8 stata aggiunta l'impostazione SessionExpiryUpdateInterval per definire l'intervallo di aggiornamento del tempo di scadenza della sessione\/cookie;\n<li class=\"l\"> \u00c8 stata effettuata una pulizia delle pagine con errori, mirata ad escludere la visualizzazione di informazioni su queste pagine da richieste;\n<li class=\"l\"> In mod_http2 \u00e8 stato preso in considerazione il valore del parametro \u00abLimitRequestFieldSize\u00bb, che in precedenza si applicava solo al controllo dei campi delle intestazioni HTTP\/1.1;\n<li class=\"l\"> \u00c8 stata garantita la creazione della configurazione mod_proxy_hcheck quando utilizzata in BalancerMember;\n<li class=\"l\"> Ridotto il consumo di memoria in mod_dav quando si utilizza il comando PROPFIND su una grande collezione;\n<li class=\"l\"> In mod_proxy e mod_ssl sono stati risolti problemi relativi all'impostazione delle configurazioni sui certificati e SSL all'interno del blocco Proxy;\n<li class=\"l\"> In mod_proxy \u00e8 consentito l'uso delle impostazioni SSLProxyCheckPeer* per tutti i moduli proxy;\n<li class=\"l\"> Sono state ampliate le funzionalit\u00e0 del modulo <noindex><a rel=\"nofollow\" href=\"https:\/\/httpd.apache.org\/docs\/2.4\/mod\/mod_md.html\">mod_md<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=47403\">sviluppato<\/a><\/noindex> progetto Let's Encrypt per automatizzare l'ottenimento e la gestione dei certificati mediante il protocollo ACME (Automatic Certificate Management Environment):\n<ul>\n<li class=\"l\"> \u00c8 stata aggiunta la seconda versione del protocollo <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=48255\">ACMEv2<\/a><\/noindex>, che ora \u00e8 applicata per impostazione predefinita e <noindex><a rel=\"nofollow\" href=\"https:\/\/community.letsencrypt.org\/t\/acme-v2-scheduled-deprecation-of-unauthenticated-resource-gets\/74380\">utilizza<\/a><\/noindex> richieste POST vuote invece di GET.\n<li class=\"l\"> \u00c8 stato aggiunto il supporto per la verifica basata su TLS-ALPN-01 (RFC 7301, Application-Layer Protocol Negotiation), che \u00e8 utilizzata in HTTP\/2.\n<li class=\"l\"> \u00c8 stata interrotta la supporto per il metodo di verifica 'tls-sni-01' (a causa di <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=47883\">vulnerabilit\u00e0<\/a><\/noindex>).\n<li class=\"l\"> Sono stati aggiunti comandi per configurare e interrompere la verifica tramite il metodo 'dns-01'.\n<li class=\"l\"> \u00c8 stata aggiunta la supporto per <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=46817\">maschere<\/a><\/noindex> nei certificati quando si attiva la verifica basata su DNS ('dns-01').\n<li class=\"l\"> \u00c8 stato implementato un gestore 'md-status' e una pagina con lo stato del certificato \u00abhttps:\/\/domain\/.httpd\/certificate-status\u00bb.\n<li class=\"l\">  Sono state aggiunte le direttive \u00abMDCertificateFile\u00bb e \u00abMDCertificateKeyFile\u00bb per configurare le impostazioni dei domini tramite file statici (senza supporto per l'auto-aggiornamento).\n<li class=\"l\"> \u00c8 stata aggiunta la direttiva \u00abMDMessageCmd\u00bb per chiamare comandi esterni in caso di eventi \u2018renewed\u2019, \u2018expiring\u2019 o \u2018errored\u2019.\n<li class=\"l\"> \u00c8 stata aggiunta la direttiva \u00abMDWarnWindow\u00bb per configurare il messaggio di avviso sulla scadenza del certificato;\n<\/ul>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Fonte: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51298\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.41 (\u0432\u044b\u043f\u0443\u0441\u043a 2.4.40 \u0431\u044b\u043b \u043f\u0440\u043e\u043f\u0443\u0449\u0435\u043d), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e 23 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 6 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2019-10081 &#8212; \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432 mod_http2, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044e \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u0440\u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0435 push-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043d\u0430 \u043e\u0447\u0435\u043d\u044c \u0440\u0430\u043d\u043d\u0435\u0439 \u0441\u0442\u0430\u0434\u0438\u0438. \u041f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 &#171;H2PushResource&#187; \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u0430 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u044c \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u043f\u0430\u043c\u044f\u0442\u0438 \u0432 \u043f\u0443\u043b\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432, \u043d\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0430 \u043a\u0440\u0430\u0445\u043e\u043c, \u0442\u0430\u043a \u043a\u0430\u043a \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u043c\u044b\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37194","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.41 (\u0432\u044b\u043f\u0443\u0441\u043a 2.4.40 \u0431\u044b\u043b \u043f\u0440\u043e\u043f\u0443\u0449\u0435\u043d), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/it\/blog\/news\/reliz-http-servera-apache-2-4-41-s-ustraneniem-uyazvimostej\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"it_IT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.41 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.41 (\u0432\u044b\u043f\u0443\u0441\u043a 2.4.40 \u0431\u044b\u043b \u043f\u0440\u043e\u043f\u0443\u0449\u0435\u043d), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/it\/blog\/news\/reliz-http-servera-apache-2-4-41-s-ustraneniem-uyazvimostej\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:16:17+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:16:17+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Rilascio del server http Apache 2.4.41 con correzioni di vulnerabilit\u00e0 | ProHoster","description":"\u00c8 stata pubblicata la versione del server HTTP Apache 2.4.41 (la versione 2.4.40 \u00e8 stata skipata), che presenta.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/news\/reliz-http-servera-apache-2-4-41-s-ustraneniem-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.41 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.41 (\u0432\u044b\u043f\u0443\u0441\u043a 2.4.40 \u0431\u044b\u043b \u043f\u0440\u043e\u043f\u0443\u0449\u0435\u043d), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e.","og:url":"https:\/\/prohoster.info\/it\/blog\/news\/reliz-http-servera-apache-2-4-41-s-ustraneniem-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:16:17+00:00","article:modified_time":"2019-10-31T19:16:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37194","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 16:40:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:31:25","updated":"2026-01-23 16:40:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/37194","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=37194"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/37194\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=37194"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=37194"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=37194"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}