{"id":102701,"date":"2021-12-22T09:36:38","date_gmt":"2021-12-22T07:36:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-http-servera-apache-2-4-52-s-ustraneniem-perepolneniya-bufera-v-mod_lua"},"modified":"2021-12-22T09:36:38","modified_gmt":"2021-12-22T07:36:38","slug":"reliz-http-servera-apache-2-4-52-s-ustraneniem-perepolneniya-bufera-v-mod_lua","status":"publish","type":"post","link":"https:\/\/prohoster.info\/nl\/blog\/news\/reliz-http-servera-apache-2-4-52-s-ustraneniem-perepolneniya-bufera-v-mod_lua","title":{"rendered":"Release van HTTP-server Apache 2.4.52 met fix voor buffer overflow in mod_lua","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>De release van de HTTP-server Apache 2.4.52 is gepubliceerd, met 25 wijzigingen en 2 kwetsbaarheden opgelost:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2021-44790 \u2014 een bufferoverloop in mod_lua, die zich manifesteert bij het parseren van multipart-verzoeken. De kwetsbaarheid betreft configuraties waarin Lua-scripts de functie r:parsebody() aanroepen voor het parseren van de aanvraaglichaam, en stelt een aanvaller in staat om bufferoverstroom te veroorzaken door een speciaal gevormde aanvraag te verzenden. Er zijn tot nu toe geen feiten van een exploit vastgesteld, maar potentieel kan dit probleem leiden tot de uitvoering van eigen code op <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/nl\/server\/dts-newyork\/\"   title=\"de server\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2693\">de server<\/a>.\n<li class=\"l\"> CVE-2021-44224 \u2014 een SSRF-kwetsbaarheid (Server Side Request Forgery) in mod_proxy, die in configuraties met de instelling \u2018ProxyRequests on\u2019 via een aanvraag van een speciaal gevormde URI kan leiden tot het omleiden van de aanvraag naar een andere handler op dezelfde server, die verbindingen via Unix Domain Socket accepteert. Dit probleem kan ook worden gebruikt om een crash te veroorzaken door voorwaarden te cre\u00ebren voor dereferencen van een null pointer. Het probleem betreft Apache httpd-versies vanaf 2.4.7.    <\/ul>\n<p>De meest opvallende wijzigingen die niet met beveiliging te maken hebben:   <\/p>\n<ul>\n<li class=\"l\"> In mod_ssl is ondersteuning toegevoegd voor builds met de OpenSSL 3-bibliotheek.\n<li class=\"l\"> De detectie van de OpenSSL-bibliotheek in autoconf-scripts is verbeterd.\n<li class=\"l\"> In mod_proxy voor tunnelingprotocollen is het mogelijk om het omleiden van half-open (half-close) TCP-verbindingen uit te schakelen door de parameter \u2018SetEnv proxy-nohalfclose\u2019 in te stellen.\n<li class=\"l\"> Extra controles zijn toegevoegd om te bevestigen dat URI's die niet voor proxying zijn bedoeld een http\/https-schema bevatten, terwijl die voor proxying wel een hostnaam bevatten.\n<li class=\"l\"> In mod_proxy_connect en mod_proxy is het verboden om de statuscode te wijzigen na deze naar de client te hebben verzonden.\n<li class=\"l\"> Bij het verzenden van tussenantwoorden na ontvangst van aanvragen met de header \u2018Expect: 100-Continue\u2019 is het resultaat voorzien van de status \u2018100 Continue\u2019, in plaats van de huidige status van de aanvraag.\n<li class=\"l\"> In mod_dav is ondersteuning toegevoegd voor CalDAV-extensies, waarbij bij het genereren van eigenschappen zowel documentelementen als eigenschapselementen in aanmerking moeten worden genomen. Nieuwe functies dav_validate_root_ns(), dav_find_child_ns(), dav_find_next_ns(), dav_find_attr_ns() en dav_find_attr() zijn toegevoegd en kunnen vanuit andere modules worden aangeroepen.\n<li class=\"l\"> In mpm_event is het probleem opgelost van het stoppen van inactieve child-processen na een piekbelasting op de server.\n<li class=\"l\"> In mod_http2 zijn regressieve wijzigingen opgelost die leiden tot onjuist gedrag bij het verwerken van de beperkingen MaxRequestsPerChild en MaxConnectionsPerChild.\n<li class=\"l\"> De mogelijkheden van de mod_md-module, die wordt gebruikt voor de automatisering van het verkrijgen en beheren van certificaten met behulp van het ACME-protocol (Automatic Certificate Management Environment), zijn uitgebreid:\n<ul>\n<li class=\"l\"> Ondersteuning voor de ACME External Account Binding (EAB) mechanisme is toegevoegd, in te schakelen met de MDExternalAccountBinding-directive. Waarden voor EAB kunnen worden ingesteld vanuit een extern JSON-bestand, zodat authenticatieparameters in het hoofdlabel niet onthuld worden. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/nl\/server\/\"   title=\"de serverconfiguratie\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"997\">de serverconfiguratie<\/a>.\n<li class=\"l\"> In de directive \u2018MDCertificateAuthority\u2019 is het gecontroleerd of de parameter URL http\/https of een van de vooraf gedefinieerde namen (\u2018LetsEncrypt\u2019, \u2018LetsEncrypt-Test\u2019, \u2018Buypass\u2019 en \u2018Buypass-Test\u2019) is opgegeven.\n<li class=\"l\">  Het is toegestaan om de directive MDContactEmail op te geven binnen de sectie .\n<li class=\"l\"> Verschillende fouten zijn opgelost, waaronder een geheugenlek dat zich voordeed bij fouten tijdens het laden van de priv\u00e9sleutel.  <\/ul>\n<\/ul>\n<p>Bron: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=56387\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.52, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e 25 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b 2 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: CVE-2021-44790 &#8212; \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 mod_lua, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0435\u0435\u0441\u044f \u043f\u0440\u0438 \u0440\u0430\u0437\u0431\u043e\u0440\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432, \u0441\u043e\u0441\u0442\u043e\u044f\u0449\u0438\u0445 \u0438\u0437 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0447\u0430\u0441\u0442\u0435\u0439 (multipart). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 Lua-\u0441\u043a\u0440\u0438\u043f\u0442\u044b \u0432\u044b\u0437\u044b\u0432\u0430\u044e\u0442 \u0444\u0443\u043d\u043a\u0446\u0438\u044e r:parsebody() \u0434\u043b\u044f \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0442\u0435\u043b\u0430 \u0437\u0430\u043f\u0440\u043e\u0441\u0430, \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430. \u0424\u0430\u043a\u0442\u043e\u0432 \u043d\u0430\u043b\u0438\u0447\u0438\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102701","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.52, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e 25 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b 2 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: CVE-2021-44790 - \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 mod_lua, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0435\u0435\u0441\u044f \u043f\u0440\u0438 \u0440\u0430\u0437\u0431\u043e\u0440\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/nl\/blog\/news\/reliz-http-servera-apache-2-4-52-s-ustraneniem-perepolneniya-bufera-v-mod_lua\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"nl_NL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.52 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 mod_lua | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.52, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e 25 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b 2 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: CVE-2021-44790 - \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 mod_lua, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0435\u0435\u0441\u044f \u043f\u0440\u0438 \u0440\u0430\u0437\u0431\u043e\u0440\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/nl\/blog\/news\/reliz-http-servera-apache-2-4-52-s-ustraneniem-perepolneniya-bufera-v-mod_lua\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-12-22T07:36:38+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-12-22T07:36:38+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47De release van de HTTP-server Apache 2.4.52 met het verhelpen van de buffer overflow in mod_lua | ProHoster","description":"De release van de HTTP-server Apache 2.4.52 is gepubliceerd, met 25 wijzigingen en 2 kwetsbaarheden verholpen: CVE-2021-44790 - buffer overflow in mod_lua, dat zich manifesteert bij de parsing van aanvragen.","canonical_url":"https:\/\/prohoster.info\/nl\/blog\/news\/reliz-http-servera-apache-2-4-52-s-ustraneniem-perepolneniya-bufera-v-mod_lua","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"nl_NL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.52 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 mod_lua | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.52, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e 25 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b 2 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: CVE-2021-44790 - \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 mod_lua, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0435\u0435\u0441\u044f \u043f\u0440\u0438 \u0440\u0430\u0437\u0431\u043e\u0440\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432.","og:url":"https:\/\/prohoster.info\/nl\/blog\/news\/reliz-http-servera-apache-2-4-52-s-ustraneniem-perepolneniya-bufera-v-mod_lua","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-12-22T07:36:38+00:00","article:modified_time":"2021-12-22T07:36:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102701","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-12-22 07:36:51","updated":"2026-02-09 21:39:49","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/102701","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/comments?post=102701"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/102701\/revisions"}],"predecessor-version":[{"id":159973,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/102701\/revisions\/159973"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/media?parent=102701"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/categories?post=102701"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/tags?post=102701"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}