{"id":37194,"date":"2019-10-31T22:16:17","date_gmt":"2019-10-31T19:16:17","guid":{"rendered":"https:\/\/prohoster.info\/blog\/reliz-http-servera-apache-2-4-41-s-ustraneniem-uyazvimostej\/"},"modified":"2019-10-31T22:16:17","modified_gmt":"2019-10-31T19:16:17","slug":"reliz-http-servera-apache-2-4-41-s-ustraneniem-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/nl\/blog\/news\/reliz-http-servera-apache-2-4-41-s-ustraneniem-uyazvimostej","title":{"rendered":"Release van de http-server Apache 2.4.41 met oplossingen voor kwetsbaarheden","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00139.html\">Gepubliceerd<\/a><\/noindex> release van de HTTP-server Apache 2.4.41 (uitgave 2.4.40 werd overgeslagen), waarin <noindex><a rel=\"nofollow\" href=\"http:\/\/www.apache.org\/dist\/httpd\/CHANGES_2.4.41\">23 wijzigingen<\/a><\/noindex> en verholpen <noindex><a rel=\"nofollow\" href=\"http:\/\/httpd.apache.org\/security\/vulnerabilities_24.html\">6 kwetsbaarheden<\/a><\/noindex>:<\/p>\n<ul>\n<li class=\"l\">  <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00140.html\">CVE-2019-10081<\/a><\/noindex> \u2014 het probleem zit in mod_http2, wat kan leiden tot geheugenbeschadiging bij het verzenden van push-aanvragen in een zeer vroeg stadium. Bij het gebruik van de instelling \u00abH2PushResource\u00bb kan het geheugen in de verzoekverwerkingspool worden overschreven, maar het probleem is beperkt tot een crash, aangezien de geschreven gegevens niet zijn gebaseerd op informatie van de client;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00145.html\">CVE-2019-9517<\/a><\/noindex> \u2014 nieuwe blootstelling <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51279\">van de aangekondigde<\/a><\/noindex> DoS-kwetsbaarheid in HTTP\/2-implementaties.<br \/>\nEen aanvaller kan het beschikbare geheugen van het proces uitputten en een hoge CPU-belasting veroorzaken door een verschuivend HTTP\/2-venster te openen om onbeperkt gegevens van de server te verzenden, terwijl het TCP-venster gesloten blijft, waardoor het feitelijk onmogelijk is om gegevens naar de socket te schrijven; <\/p>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00144.html\">CVE-2019-10098<\/a><\/noindex> \u2014 het probleem zit in mod_rewrite, waardoor de server kan worden gebruikt om aanvragen door te sturen naar andere bronnen (open redirect). Sommige instellingen van mod_rewrite kunnen leiden tot het doorsturen van de gebruiker naar een andere link, gecodeerd met behulp van het regeleinde in de parameter die wordt gebruikt in de bestaande redirect. Om het probleem te blokkeren, kan de vlag PCRE_DOTALL in RegexDefaultOptions worden gebruikt, die nu standaard is ingesteld;\n<li class=\"l\">  <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00142.html\">CVE-2019-10092<\/a><\/noindex> \u2014 mogelijkheid van cross-site scripting op foutpagina's die door mod_proxy worden weergegeven. Op deze pagina's wordt de URL die uit de aanvraag is verkregen in de link ingevoegd, waar de aanvaller door het ontsnappen van tekens willekeurige HTML-code kan invoegen;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00143.html\">CVE-2019-10097<\/a><\/noindex> \u2014 buffer overflow en dereferentie van een NULL-pointer in mod_remoteip, ge\u00ebxploiteerd via manipulatie van de PROXY-protocolheader. De aanval kan alleen worden uitgevoerd vanaf de server die in de proxy-instellingen wordt gebruikt, en niet via de clientaanvraag;\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00141.html\">CVE-2019-10082<\/a><\/noindex> \u2014 kwetsbaarheid in mod_http2 die het mogelijk maakt om tijdens het be\u00ebindigen van de verbinding een leesoperatie van contents uit een al vrijgegeven geheugenruimte (read-after-free) te initi\u00ebren.\n<\/ul>\n<p>De meest opvallende wijzigingen die niet met beveiliging te maken hebben: <\/p>\n<ul>\n<li class=\"l\"> In mod_proxy_balancer is de bescherming tegen XSS\/XSRF-aanvallen vanuit vertrouwde knooppunten versterkt;\n<li class=\"l\"> In mod_session is de instelling SessionExpiryUpdateInterval toegevoegd om het interval voor het bijwerken van de levensduur van de sessie\/cookie te bepalen;\n<li class=\"l\"> Er is een opschoning van foutpagina's uitgevoerd, gericht op het uitsluiten van het weergeven van informatie uit aanvragen op deze pagina's;\n<li class=\"l\"> In mod_http2 is rekening gehouden met de parameterwaarde \u00abLimitRequestFieldSize\u00bb, die voorheen alleen gold voor de controle van HTTP\/1.1-headers;\n<li class=\"l\"> Configuration creation for mod_proxy_hcheck has been ensured when used in BalancerMember;\n<li class=\"l\"> Memory consumption in mod_dav has been reduced when using the PROPFIND command over a large collection;\n<li class=\"l\"> Issues with specifying certificate and SSL settings within the Proxy block in mod_proxy and mod_ssl have been resolved;\n<li class=\"l\"> The application of SSLProxyCheckPeer* settings for all proxy modules is now allowed in mod_proxy;\n<li class=\"l\"> De mogelijkheden van de module zijn uitgebreid <noindex><a rel=\"nofollow\" href=\"https:\/\/httpd.apache.org\/docs\/2.4\/mod\/mod_md.html\">mod_md<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=47403\">ontwikkeld door<\/a><\/noindex> het project Let\u2019s Encrypt voor het automatiseren van het verkrijgen en onderhouden van certificaten met behulp van het ACME-protocol (Automatic Certificate Management Environment):\n<ul>\n<li class=\"l\"> The second version of the protocol <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=48255\">ACMEv2<\/a><\/noindex>, which is now applied by default and <noindex><a rel=\"nofollow\" href=\"https:\/\/community.letsencrypt.org\/t\/acme-v2-scheduled-deprecation-of-unauthenticated-resource-gets\/74380\">gebruikt<\/a><\/noindex> empty POST requests instead of GET.\n<li class=\"l\"> Support for validation based on the TLS-ALPN-01 extension (RFC 7301, Application-Layer Protocol Negotiation), which is used in HTTP\/2, has been added.\n<li class=\"l\"> De ondersteuning voor de verificatiemethode \u2018tls-sni-01\u2019 is be\u00ebindigd (vanwege <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=47883\">kwetsbaarheden<\/a><\/noindex>).\n<li class=\"l\"> Er zijn opdrachten toegevoegd voor het instellen en be\u00ebindigen van de verificatie met de methode \u2018dns-01\u2019.\n<li class=\"l\"> Ondersteuning toegevoegd voor <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=46817\">maskers<\/a><\/noindex> in de certificaten bij het inschakelen van verificatie op basis van DNS (\u2018dns-01\u2019).\n<li class=\"l\"> Er is een handler \u2018md-status\u2019 ge\u00efmplementeerd en een pagina met de status van het certificaat \u2018https:\/\/domain\/.httpd\/certificate-status\u2019.\n<li class=\"l\">  Er zijn de directe opdrachten \u2018MDCertificateFile\u2019 en \u2018MDCertificateKeyFile\u2019 toegevoegd voor het configureren van domeinparameters via statische bestanden (zonder ondersteuning voor automatische updates).\n<li class=\"l\"> De richtlijn &#171;MDMessageCmd&#187; is toegevoegd voor het aanroepen van externe commando's bij het optreden van 'renewed', 'expiring' of 'errored' gebeurtenissen.\n<li class=\"l\"> De richtlijn &#171;MDWarnWindow&#187; is toegevoegd voor het configureren van een waarschuwing over het verlopen van het certificaat;\n<\/ul>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Bron: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51298\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.41 (\u0432\u044b\u043f\u0443\u0441\u043a 2.4.40 \u0431\u044b\u043b \u043f\u0440\u043e\u043f\u0443\u0449\u0435\u043d), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e 23 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 6 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: CVE-2019-10081 &#8212; \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432 mod_http2, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u044e \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u0440\u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0435 push-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043d\u0430 \u043e\u0447\u0435\u043d\u044c \u0440\u0430\u043d\u043d\u0435\u0439 \u0441\u0442\u0430\u0434\u0438\u0438. \u041f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 &#171;H2PushResource&#187; \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u0430 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u044c \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u043f\u0430\u043c\u044f\u0442\u0438 \u0432 \u043f\u0443\u043b\u0435 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432, \u043d\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0430 \u043a\u0440\u0430\u0445\u043e\u043c, \u0442\u0430\u043a \u043a\u0430\u043a \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u043c\u044b\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37194","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.41 (\u0432\u044b\u043f\u0443\u0441\u043a 2.4.40 \u0431\u044b\u043b \u043f\u0440\u043e\u043f\u0443\u0449\u0435\u043d), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/nl\/blog\/news\/reliz-http-servera-apache-2-4-41-s-ustraneniem-uyazvimostej\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"nl_NL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.41 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.41 (\u0432\u044b\u043f\u0443\u0441\u043a 2.4.40 \u0431\u044b\u043b \u043f\u0440\u043e\u043f\u0443\u0449\u0435\u043d), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/nl\/blog\/news\/reliz-http-servera-apache-2-4-41-s-ustraneniem-uyazvimostej\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:16:17+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:16:17+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Release of the Apache HTTP server 2.4.41 with vulnerability fixes | ProHoster","description":"The release of the HTTP server Apache 2.4.41 has been published (the release 2.4.40 was skipped), in which it is presented.","canonical_url":"https:\/\/prohoster.info\/nl\/blog\/news\/reliz-http-servera-apache-2-4-41-s-ustraneniem-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"nl_NL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.41 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.41 (\u0432\u044b\u043f\u0443\u0441\u043a 2.4.40 \u0431\u044b\u043b \u043f\u0440\u043e\u043f\u0443\u0449\u0435\u043d), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e.","og:url":"https:\/\/prohoster.info\/nl\/blog\/news\/reliz-http-servera-apache-2-4-41-s-ustraneniem-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:16:17+00:00","article:modified_time":"2019-10-31T19:16:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37194","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 16:40:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:31:25","updated":"2026-01-23 16:40:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/37194","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/comments?post=37194"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/posts\/37194\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/media?parent=37194"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/categories?post=37194"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/nl\/wp-json\/wp\/v2\/tags?post=37194"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}