The lightweight HTTP server lighttpd 1.4.76 has been released, focusing on high performance, security, standards compliance, and flexibility. Lighttpd is suitable for use in high-load systems and aims for low memory and CPU resource consumption. The project's code is written in C and is distributed under the BSD license.
In de nieuwe versie:
- Detection of 'Continuation flood' attack, carried out by sending a non-ending stream of CONTINUATION frames over HTTP/2 without setting the END_HEADERS flag, has been ensured. It is claimed that this attack does not lead to a denial of service for lighttpd, but detection has been added as an additional measure, along with sending a GO_AWAY response. server An incident involving a backdoor being introduced into the xz package has been noted. When creating releases for dependency builds, code is now obtained from Git using the command 'git archive' with release tag verification and without downloading pre-made code archives.
- By default, a built-in mimetype.assign file is provided.
- Support for the MPTCP (MultiPath TCP) extension has been added, which is not enabled by default.
- Improved support for GNU/Hurd and NetBSD 10 platforms.
- The number of system calls made when connecting to the backend has been reduced.
- In upcoming releases, TLSv1.3 is expected to be set as the minimum supported version of the TLS protocol by default (currently, the MinProtocol parameter is set to TLSv1.2). In the future, the server.error-handler-404 handler will be limited to handling only 404 errors (currently handling both 404 and 403 errors).
- It is also worth noting the release of the HTTP server Apache 2.4.59, which includes 21 changes and addresses three vulnerabilities:
CVE-2024-27316 — a vulnerability leading to memory exhaustion during a 'Continuation flood' attack.
- CVE-2024-24795, CVE-2023-38709 — the possibility to carry out an attack by splitting HTTP responses on frontend-backend systems, allowing for the injection of additional response headers or the splitting of responses to intercept the content of responses handled in the same thread between the frontend and the backend.
- A CGIScriptTimeout parameter has been added to the mod_cgi module to set the script execution timeout.
- In mod_xml2enc, compatibility with libxml2 2.12.0 and newer releases has been ensured.
- In mod_xml2enc, compatibility with libxml2 2.12.0 and newer releases has been ensured.
- In mod_ssl, standaard OpenSSL-functies zijn geïmplementeerd voor het samenstellen van lijsten van namen van certificeringsinstanties bij de verwerking van de instructies SSLCACertificatePath en SSLCADNRequestPath.
- In mod_xml2enc is XML-verwerking voor alle MIME-typen text/* en XML verbeterd om gegevenscorruptie in Microsoft OOXML-formaten te voorkomen.
- In de tool htcacheclean is bij het opgeven van de opties -a/-A de mogelijkheid toegevoegd om alle bestanden in elke subdirectory te doorlopen.
- In mod_ssl is het toegestaan om te verwijzen naar bestanden die certificaten van certificeringsinstanties bevatten in de instructies SSLProxyMachineCertificateFile/Path.
- In de documentatie voor de tools htpasswd, htdbm en dbmmanage is verduidelijkt dat hiervoor hashing wordt gebruikt in plaats van encryptie van wachtwoorden.
- In htpasswd is ondersteuning voor het verwerken van wachtwoordhashes met behulp van het SHA-2-algoritme toegevoegd.
- In mod_env is het toegestaan om systeemomgevingsvariabelen te overschrijven.
- In mod_ldap is HTML-gegevens in de ldap-status header geëscapeerd.
- In mod_ssl is de compatibiliteit met OpenSSL 3 verbeterd en wordt ervoor gezorgd dat vrijgegeven geheugen terugkomt naar het systeem.
- In mod_proxy is het mogelijk gemaakt om TTL in te stellen voor de levensduur van DNS-cache-antwoorden.
- In mod_proxy is de ondersteuning voor een derde argument aan de ProxyRemote-parameter toegevoegd, waarmee de gebruikte inloggegevens voor Basic-authenticatie naar de externe proxy kunnen worden ingesteld.
Bron: opennet.ru
