Apache 2.4.43 HTTP server release (version 2.4.42 was skipped), featuring un novērsts :
- CVE-2020-1927: vulnerability in mod_rewrite that allows the server to redirect requests to other resources (open redirect). Some mod_rewrite settings can lead to users being redirected to another link encoded with a newline character within a parameter used in an existing redirect.
- CVE-2020-1934: vulnerability in mod_proxy_ftp. Using uninitialized values may lead to leakage of memory content when proxying requests to an FTP server controlled by an attacker.
- Memory leak in mod_ssl occurring during the OCSP request pinning.
Visredzamākās izmaiņas, kas nav saistītas ar drošību:
- New module added , providing integration with the system manager systemd. The module allows httpd to be used in services with type ‘Type=notify’.
- Support for cross-compilation has been added to apxs.
- Enhanced capabilities of the mod_md module developed by the Let's Encrypt project for automating the acquisition and maintenance of certificates using the ACME (Automatic Certificate Management Environment) protocol:
- Added directive MDContactEmail, which allows specifying a contact email that does not overlap with the data from the ServerAdmin directive.
- For all virtual hosts, a check for the support of the protocol used during the establishment of the secure communication channel (‘tls-alpn-01’) has been provided.
- Usage of mod_md directives in <If> and <Macro> blocks is allowed.
- Ensured replacement of past settings when reusing MDCAChallenges.
- Added the ability to configure a URL for CTLog Monitor.
- For specific commands defined in the MDMessageCmd directive, a call with the argument ‘installed’ is ensured when activating a new certificate after server restart (for example, it can be used for copying or transforming a new certificate for other applications).
- mod_proxy_hcheck added support for %{Content-Type} mask in check expressions.
- In mod_usertrack, CookieSameSite, CookieHTTPOnly, and CookieSecure modes have been added for configuring usertrack Cookie handling.
- In mod_proxy_ajp, a ‘secret’ parameter for proxy handlers has been implemented to support the outdated AJP13 authentication protocol.
- Added a configuration set for OpenWRT.
- mod_ssl ir pievienota atbalsts privāto atslēgu un sertifikātu izmantošanai no OpenSSL ENGINE, norādot PKCS#11 URI SSLCertificateFile/KeyFile.
- Izdota testēšana, izmantojot nepārtrauktas integrācijas sistēmu Travis CI.
- Saspringts Transfer-Encoding virsrakstu parsēšana.
- mod_ssl nodrošina TLS protokola saskaņošanu saistībā ar virtuālajiem viesiem (atbalsta, ja tiek būvēts ar OpenSSL-1.1.1+).
- Pateicoties komandu tabulu hashing, ir paātrināts 'graceful' režīma restartēšana (bez norautiem pieprasījumu apkalpošanas procesiem).
- mod_lua ir pievienotas r:headers_in_table, r:headers_out_table, r:err_headers_out_table, r:notes_table un r:subprocess_env_table tabulas, kas pieejamas tikai lasīšanai. Tabulām atļauts piešķirt 'nil' vērtības.
- mod_authn_socache ir palielināts kešējamo rindu izmēra limits no 100 līdz 256.
Avots: opennet.lv
