{"id":91158,"date":"2020-08-09T01:43:01","date_gmt":"2020-08-08T23:43:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-http-servera-apache-2-4-46-s-ustraneniem-uyazvimostej"},"modified":"2020-08-09T01:43:01","modified_gmt":"2020-08-08T23:43:01","slug":"reliz-http-servera-apache-2-4-46-s-ustraneniem-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/reliz-http-servera-apache-2-4-46-s-ustraneniem-uyazvimostej","title":{"rendered":"Wydanie serwera http Apache 2.4.46 z usuni\u0119tymi lukami","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00146.html\">Opublikowano<\/a><\/noindex> wydanie serwera HTTP Apache 2.4.46 (pomi\u0144 wydania 2.4.44 i 2.4.45), w kt\u00f3rym przedstawiono <noindex><a rel=\"nofollow\" href=\"http:\/\/www.apache.org\/dist\/httpd\/CHANGES_2.4.46\">17 zmian<\/a><\/noindex> i usuni\u0119to <noindex><a rel=\"nofollow\" href=\"http:\/\/httpd.apache.org\/security\/vulnerabilities_24.html\">3 luki<\/a><\/noindex>:<\/p>\n<ul>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00147.html\">CVE-2020-11984<\/a><\/noindex> \u2014 przepe\u0142nienie bufora w module mod_proxy_uwsgi, kt\u00f3re mo\u017ce prowadzi\u0107 do wycieku informacji lub wykonania kodu na serwerze przy wysy\u0142aniu specjalnie przygotowanego \u017c\u0105dania. Eksploatacja luk bezpiecze\u0144stwa odbywa si\u0119 poprzez przesy\u0142anie bardzo d\u0142ugiego nag\u0142\u00f3wka HTTP. Aby zapewni\u0107 ochron\u0119, wprowadzono blokad\u0119 nag\u0142\u00f3wk\u00f3w d\u0142u\u017cszych ni\u017c 16K (ograniczenie okre\u015blone w specyfikacji protoko\u0142u).\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00149.html\">CVE-2020-11993<\/a><\/noindex> \u2014 luka w module mod_http2, kt\u00f3ra pozwala na spowodowanie awarii procesu przy wysy\u0142aniu \u017c\u0105dania ze specjalnie przygotowanym nag\u0142\u00f3wkiem HTTP\/2. Problematyczna sytuacja wyst\u0119puje przy w\u0142\u0105czeniu debugowania lub \u015bledzenia w module mod_http2 i wyra\u017ca si\u0119 w uszkodzeniu zawarto\u015bci pami\u0119ci z powodu warunku wy\u015bcigu podczas zapisywania informacji w logu. Problema nie wyst\u0119puje przy ustawieniu LogLevel na warto\u015b\u0107 \u201einfo\u201d.\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00150.html\">CVE-2020-9490<\/a><\/noindex> \u2014 luka w module mod_http2, kt\u00f3ra pozwala na spowodowanie awarii procesu przy wysy\u0142aniu przez HTTP\/2 \u017c\u0105dania ze specjalnie przygotowan\u0105 warto\u015bci\u0105 nag\u0142\u00f3wka \u2018Cache-Digest\u2019 (awaria wyst\u0119puje przy pr\u00f3bie wykonania operacji HTTP\/2 PUSH dla zasobu). Aby zablokowa\u0107 luk\u0119, mo\u017cna u\u017cy\u0107 ustawienia \u201eH2Push off\u201d.\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00148.html\">CVE-2020-11985<\/a><\/noindex> \u2014 luka w mod_remoteip, kt\u00f3ra pozwala na przeprowadzenie spoofingu adres\u00f3w IP podczas proxy, korzystaj\u0105c z mod_remoteip i mod_rewrite. Problem wyst\u0119puje tylko w wersjach od 2.4.1 do 2.4.23.\n<\/ul>\n<p>Najbardziej zauwa\u017calne zmiany niezwi\u0105zane z bezpiecze\u0144stwem: <\/p>\n<ul>\n<li class=\"l\"> Usuni\u0119to wsparcie dla roboczej specyfikacji z mod_http2 <noindex><a rel=\"nofollow\" href=\"https:\/\/datatracker.ietf.org\/doc\/draft-kazuho-h2-cache-digest\/\">kazuho-h2-cache-digest<\/a><\/noindex>, kt\u00f3rego promocja zosta\u0142a zako\u0144czona.\n<li class=\"l\"> Zmiana zachowania dyrektywy \u201eLimitRequestFields\u201d w mod_http2, ustawienie warto\u015bci 0 teraz wy\u0142\u0105cza ograniczenie.\n<li class=\"l\"> W mod_http2 zapewniono obs\u0142ug\u0119 po\u0142\u0105cze\u0144 g\u0142\u00f3wnych i podrz\u0119dnych (master\/secondary) oraz oznaczenie metod w zale\u017cno\u015bci od u\u017cycia.\n<li class=\"l\"> W przypadku otrzymania niepoprawnej zawarto\u015bci nag\u0142\u00f3wka Last-Modified od skryptu FCGI\/CGI, ten nag\u0142\u00f3wek jest teraz usuwany, a nie zamieniany na epok\u0119 Unix (Unix epoch).\n<li class=\"l\"> Do kodu dodano funkcj\u0119 ap_parse_strict_length() do \u015bcis\u0142ego rozpoznawania rozmiaru tre\u015bci.\n<li class=\"l\"> W mod_proxy_fcgi w ProxyFCGISetEnvIf zapewniono usuni\u0119cie zmiennych \u015brodowiskowych, je\u015bli zadany wyraz zwraca False.\n<li class=\"l\"> Usuni\u0119to stan wy\u015bcigu oraz mo\u017cliw\u0105 awari\u0119 mod_ssl przy u\u017cyciu certyfikatu klienta, zdefiniowanego przez ustawienie SSLProxyMachineCertificateFile.\n<li class=\"l\"> Usuni\u0119to wyciek pami\u0119ci w mod_ssl.\n<li class=\"l\"> W mod_proxy_http2 zapewniono u\u017cycie parametru proxy \u201e<noindex><a rel=\"nofollow\" href=\"https:\/\/httpd.apache.org\/docs\/2.4\/mod\/mod_proxy.html\">ping<\/a><\/noindex>\u201d przy sprawdzaniu funkcjonalno\u015bci nowego lub ponownie u\u017cywanego po\u0142\u0105czenia z backendem.\n<li class=\"l\"> Zaprzestano wi\u0105zania httpd z opcj\u0105 \u201e-lsystemd\u201d, je\u015bli aktywowany jest mod_systemd.\n<li class=\"l\"> W mod_proxy_http2 uwzgl\u0119dniono ustawienie ProxyTimeout podczas oczekiwania na dane przychodz\u0105ce przez po\u0142\u0105czenia z backendem.\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>\u0179r\u00f3d\u0142o: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53517\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.46 (\u0432\u044b\u043f\u0443\u0441\u043a\u0438 2.4.44 \u0438 2.4.45 \u0431\u044b\u043b\u0438 \u043f\u0440\u043e\u043f\u0443\u0449\u0435\u043d\u044b), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e 17 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 3 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: CVE-2020-11984 &#8212; \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 mod_proxy_uwsgi, \u043a\u043e\u0442\u043e\u0440\u043e\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043f\u0440\u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0443 \u043e\u0447\u0435\u043d\u044c \u0434\u043b\u0438\u043d\u043d\u043e\u0433\u043e HTTP-\u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430. \u0414\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-91158","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.46 (\u0432\u044b\u043f\u0443\u0441\u043a\u0438 2.4.44 \u0438 2.4.45 \u0431\u044b\u043b\u0438 \u043f\u0440\u043e\u043f\u0443\u0449\u0435\u043d\u044b), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/pl\/blog\/news\/reliz-http-servera-apache-2-4-46-s-ustraneniem-uyazvimostej\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"pl_PL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.46 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.46 (\u0432\u044b\u043f\u0443\u0441\u043a\u0438 2.4.44 \u0438 2.4.45 \u0431\u044b\u043b\u0438 \u043f\u0440\u043e\u043f\u0443\u0449\u0435\u043d\u044b), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/pl\/blog\/news\/reliz-http-servera-apache-2-4-46-s-ustraneniem-uyazvimostej\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-08-08T23:43:01+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-08-08T23:43:01+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Wydanie serwera http Apache 2.4.46 z usuni\u0119ciem luk w zabezpieczeniach | ProHoster","description":"Opublikowano wydanie serwera HTTP Apache 2.4.46 (wydania 2.4.44 i 2.4.45 zosta\u0142y pomini\u0119te), w kt\u00f3rym.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/reliz-http-servera-apache-2-4-46-s-ustraneniem-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.46 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.46 (\u0432\u044b\u043f\u0443\u0441\u043a\u0438 2.4.44 \u0438 2.4.45 \u0431\u044b\u043b\u0438 \u043f\u0440\u043e\u043f\u0443\u0449\u0435\u043d\u044b), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/reliz-http-servera-apache-2-4-46-s-ustraneniem-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-08T23:43:01+00:00","article:modified_time":"2020-08-08T23:43:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91158","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:33:24","updated":"2022-09-28 03:36:52","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/91158","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=91158"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/91158\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=91158"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=91158"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=91158"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}