{"id":91158,"date":"2020-08-09T01:43:01","date_gmt":"2020-08-08T23:43:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-http-servera-apache-2-4-46-s-ustraneniem-uyazvimostej"},"modified":"2020-08-09T01:43:01","modified_gmt":"2020-08-08T23:43:01","slug":"reliz-http-servera-apache-2-4-46-s-ustraneniem-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/reliz-http-servera-apache-2-4-46-s-ustraneniem-uyazvimostej","title":{"rendered":"Lan\u00e7amento do servidor HTTP Apache 2.4.46 com corre\u00e7\u00e3o de vulnerabilidades","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00146.html\">Publicado<\/a><\/noindex> lan\u00e7amento do servidor HTTP Apache 2.4.46 (as vers\u00f5es 2.4.44 e 2.4.45 foram puladas), que apresenta <noindex><a rel=\"nofollow\" href=\"http:\/\/www.apache.org\/dist\/httpd\/CHANGES_2.4.46\">17 modifica\u00e7\u00f5es<\/a><\/noindex> e corrige <noindex><a rel=\"nofollow\" href=\"http:\/\/httpd.apache.org\/security\/vulnerabilities_24.html\">3 vulnerabilidades<\/a><\/noindex>:<\/p>\n<ul>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00147.html\">CVE-2020-11984<\/a><\/noindex> \u2014 estouro de buffer no m\u00f3dulo mod_proxy_uwsgi, que pode levar a vazamentos de informa\u00e7\u00f5es ou execu\u00e7\u00e3o de c\u00f3digo no servidor ao enviar uma solicita\u00e7\u00e3o formatada de maneira especial. A explora\u00e7\u00e3o da vulnerabilidade ocorre atrav\u00e9s do envio de um cabe\u00e7alho HTTP muito longo. Para prote\u00e7\u00e3o, foi adicionada uma limita\u00e7\u00e3o para cabe\u00e7alhos com mais de 16K (limita\u00e7\u00e3o definida na especifica\u00e7\u00e3o do protocolo).\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00149.html\">CVE-2020-11993<\/a><\/noindex> \u2014 vulnerabilidade no m\u00f3dulo mod_http2, permitindo a falha do processo ao enviar uma solicita\u00e7\u00e3o com um cabe\u00e7alho HTTP\/2 formatado de maneira especial. O problema se manifesta ao habilitar depura\u00e7\u00e3o ou rastreamento no m\u00f3dulo mod_http2 e se expressa na corrup\u00e7\u00e3o do conte\u00fado da mem\u00f3ria devido a uma condi\u00e7\u00e3o de corrida ao salvar informa\u00e7\u00f5es no log. O problema n\u00e3o se manifesta quando o LogLevel \u00e9 definido como 'info'.\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00150.html\">CVE-2020-9490<\/a><\/noindex> \u2014 vulnerabilidade no m\u00f3dulo mod_http2, permitindo a falha do processo ao enviar, atrav\u00e9s do HTTP\/2, uma solicita\u00e7\u00e3o com um valor de cabe\u00e7alho 'Cache-Digest' formatado de maneira especial (a falha ocorre ao tentar executar uma opera\u00e7\u00e3o HTTP\/2 PUSH para o recurso). Para bloquear a vulnerabilidade, pode-se usar a configura\u00e7\u00e3o 'H2Push off'.\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00148.html\">CVE-2020-11985<\/a><\/noindex> \u2014 vulnerabilidade mod_remoteip, permitindo spoofing de endere\u00e7os IP ao fazer proxy, usando mod_remoteip e mod_rewrite. O problema se manifesta apenas para vers\u00f5es de 2.4.1 a 2.4.23.\n<\/ul>\n<p>As modifica\u00e7\u00f5es mais not\u00e1veis, n\u00e3o relacionadas \u00e0 seguran\u00e7a: <\/p>\n<ul>\n<li class=\"l\"> O suporte \u00e0 especifica\u00e7\u00e3o de rascunho foi removido de mod_http2 <noindex><a rel=\"nofollow\" href=\"https:\/\/datatracker.ietf.org\/doc\/draft-kazuho-h2-cache-digest\/\">kazuho-h2-cache-digest<\/a><\/noindex>, cuja promo\u00e7\u00e3o foi descontinuada.\n<li class=\"l\"> Comportamento da diretiva 'LimitRequestFields' foi alterado no mod_http2, especificar um valor 0 agora desativa a limita\u00e7\u00e3o.\n<li class=\"l\"> Em mod_http2, foi garantido o tratamento das conex\u00f5es principais e secund\u00e1rias (master\/secondary) e a sinaliza\u00e7\u00e3o dos m\u00e9todos conforme o uso.\n<li class=\"l\"> Caso um conte\u00fado de cabe\u00e7alho Last-Modified incorreto seja recebido de um script FCGI\/CGI, este cabe\u00e7alho agora \u00e9 removido, em vez de substitu\u00eddo pelo tempo da era Unix.\n<li class=\"l\"> Uma fun\u00e7\u00e3o ap_parse_strict_length() foi adicionada ao c\u00f3digo para an\u00e1lise rigorosa do tamanho do conte\u00fado.\n<li class=\"l\"> Em mod_proxy_fcgi, no ProxyFCGISetEnvIf, foi garantida a remo\u00e7\u00e3o de vari\u00e1veis de ambiente se a express\u00e3o fornecida retornar False.\n<li class=\"l\"> Corrigido uma condi\u00e7\u00e3o de corrida e poss\u00edvel falha do mod_ssl ao usar um certificado de cliente configurado atrav\u00e9s da op\u00e7\u00e3o SSLProxyMachineCertificateFile.\n<li class=\"l\"> Corre\u00e7\u00e3o de vazamento de mem\u00f3ria no mod_ssl.\n<li class=\"l\"> No mod_proxy_http2, foi garantido o uso do par\u00e2metro proxy '<noindex><a rel=\"nofollow\" href=\"https:\/\/httpd.apache.org\/docs\/2.4\/mod\/mod_proxy.html\">ping<\/a><\/noindex>\u2019 ao verificar a funcionalidade de uma nova conex\u00e3o ou de uma conex\u00e3o reutilizada com o backend.\n<li class=\"l\"> A vincula\u00e7\u00e3o do httpd com a op\u00e7\u00e3o '-lsystemd' foi interrompida se o mod_systemd estiver ativado.\n<li class=\"l\"> No mod_proxy_http2, foi considerado o ajuste ProxyTimeout ao aguardar dados de entrada atrav\u00e9s das conex\u00f5es com o backend.\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Fonte: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53517\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.46 (\u0432\u044b\u043f\u0443\u0441\u043a\u0438 2.4.44 \u0438 2.4.45 \u0431\u044b\u043b\u0438 \u043f\u0440\u043e\u043f\u0443\u0449\u0435\u043d\u044b), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e 17 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 3 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: CVE-2020-11984 &#8212; \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 mod_proxy_uwsgi, \u043a\u043e\u0442\u043e\u0440\u043e\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043f\u0440\u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0443 \u043e\u0447\u0435\u043d\u044c \u0434\u043b\u0438\u043d\u043d\u043e\u0433\u043e HTTP-\u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430. \u0414\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-91158","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.46 (\u0432\u044b\u043f\u0443\u0441\u043a\u0438 2.4.44 \u0438 2.4.45 \u0431\u044b\u043b\u0438 \u043f\u0440\u043e\u043f\u0443\u0449\u0435\u043d\u044b), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/pt\/blog\/news\/reliz-http-servera-apache-2-4-46-s-ustraneniem-uyazvimostej\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"pt_PT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.46 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.46 (\u0432\u044b\u043f\u0443\u0441\u043a\u0438 2.4.44 \u0438 2.4.45 \u0431\u044b\u043b\u0438 \u043f\u0440\u043e\u043f\u0443\u0449\u0435\u043d\u044b), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/pt\/blog\/news\/reliz-http-servera-apache-2-4-46-s-ustraneniem-uyazvimostej\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-08-08T23:43:01+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-08-08T23:43:01+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Lan\u00e7amento do servidor http Apache 2.4.46 com corre\u00e7\u00e3o de vulnerabilidades | ProHoster","description":"Lan\u00e7ado o servidor HTTP Apache 2.4.46 (os lan\u00e7amentos 2.4.44 e 2.4.45 foram pulados), no qual.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/reliz-http-servera-apache-2-4-46-s-ustraneniem-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.46 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.46 (\u0432\u044b\u043f\u0443\u0441\u043a\u0438 2.4.44 \u0438 2.4.45 \u0431\u044b\u043b\u0438 \u043f\u0440\u043e\u043f\u0443\u0449\u0435\u043d\u044b), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/reliz-http-servera-apache-2-4-46-s-ustraneniem-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-08T23:43:01+00:00","article:modified_time":"2020-08-08T23:43:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91158","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:33:24","updated":"2022-09-28 03:36:52","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/91158","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=91158"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/91158\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=91158"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=91158"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=91158"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}