{"id":91158,"date":"2020-08-09T01:43:01","date_gmt":"2020-08-08T23:43:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-http-servera-apache-2-4-46-s-ustraneniem-uyazvimostej"},"modified":"2020-08-09T01:43:01","modified_gmt":"2020-08-08T23:43:01","slug":"reliz-http-servera-apache-2-4-46-s-ustraneniem-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/reliz-http-servera-apache-2-4-46-s-ustraneniem-uyazvimostej","title":{"rendered":"Vydanie HTTP servera Apache 2.4.46 s odstr\u00e1nen\u00edm zranite\u013enost\u00ed","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00146.html\">Zverejnen\u00e9<\/a><\/noindex> vydanie HTTP servera Apache 2.4.46 (verzie 2.4.44 a 2.4.45 boli vynechan\u00e9), v ktorom s\u00fa predstaven\u00e9 <noindex><a rel=\"nofollow\" href=\"http:\/\/www.apache.org\/dist\/httpd\/CHANGES_2.4.46\">17 zmien<\/a><\/noindex> a odstr\u00e1nen\u00e9 <noindex><a rel=\"nofollow\" href=\"http:\/\/httpd.apache.org\/security\/vulnerabilities_24.html\">3 zranite\u013enosti<\/a><\/noindex>:<\/p>\n<ul>\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00147.html\">CVE-2020-11984<\/a><\/noindex> \u2014 preplnenie vyrovn\u00e1vacej pam\u00e4te v module mod_proxy_uwsgi, ktor\u00e9 m\u00f4\u017ee vies\u0165 k \u00faniku inform\u00e1ci\u00ed alebo vykonaniu k\u00f3du na serveri pri zaslan\u00ed \u0161peci\u00e1lne upraven\u00e9ho po\u017eiadavku. Zneu\u017eitie zranite\u013enosti sa uskuto\u010d\u0148uje prostredn\u00edctvom odoslania ve\u013emi dlh\u00e9ho HTTP hlavi\u010dky. Na ochranu bola pridan\u00e1 blok\u00e1cia hlavi\u010diek dlh\u0161\u00edch ako 16K (obmedzenie stanoven\u00e9 v \u0161pecifik\u00e1cii protokolu).\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00149.html\">CVE-2020-11993<\/a><\/noindex> \u2014 zranite\u013enos\u0165 v module mod_http2, ktor\u00e1 umo\u017e\u0148uje sp\u00f4sobi\u0165 zlyhanie procesu pri zaslan\u00ed po\u017eiadavku so \u0161peci\u00e1lne upravenou hlavi\u010dkou HTTP\/2. Probl\u00e9m sa prejavuje pri zapnutej laden\u00ed alebo sledovan\u00ed v module mod_http2 a prejavuje sa po\u0161koden\u00edm obsahu pam\u00e4te v d\u00f4sledku stavu pretekania pri ukladan\u00ed inform\u00e1ci\u00ed do logu. Probl\u00e9m sa neprejavuje pri nastaven\u00ed LogLevel na hodnotu \u201einfo\u201c.\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00150.html\">CVE-2020-9490<\/a><\/noindex> \u2014 zranite\u013enos\u0165 v module mod_http2, ktor\u00e1 umo\u017e\u0148uje sp\u00f4sobi\u0165 zlyhanie procesu pri odoslan\u00ed prostredn\u00edctvom HTTP\/2 po\u017eiadavku so \u0161peci\u00e1lne upravenou hlavi\u010dkou 'Cache-Digest' (zlyhanie nastane pri pokuse o vykonanie oper\u00e1cie HTTP\/2 PUSH pre zdroj). Na blokovanie zranite\u013enosti je mo\u017en\u00e9 pou\u017ei\u0165 nastavenie \u201eH2Push off\u201c.\n<li class=\"l\"> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.mail-archive.com\/announce@httpd.apache.org\/msg00148.html\">CVE-2020-11985<\/a><\/noindex> \u2014 zranite\u013enos\u0165 mod_remoteip, ktor\u00e1 umo\u017e\u0148uje vykona\u0165 spoofing IP adries pri proxy, vyu\u017eit\u00edm mod_remoteip a mod_rewrite. Probl\u00e9m sa prejavuje iba pre vydania od 2.4.1 po 2.4.23.\n<\/ul>\n<p>Najv\u00fdraznej\u0161ie zmeny, ktor\u00e9 sa net\u00fdkaj\u00fa bezpe\u010dnosti: <\/p>\n<ul>\n<li class=\"l\"> Z mod_http2 bola odstr\u00e1nen\u00e1 podpora n\u00e1vrhovej \u0161pecifik\u00e1cie <noindex><a rel=\"nofollow\" href=\"https:\/\/datatracker.ietf.org\/doc\/draft-kazuho-h2-cache-digest\/\">kazuho-h2-cache-digest<\/a><\/noindex>, ktor\u00e9ho propag\u00e1cia bola zastaven\u00e1.\n<li class=\"l\"> Zmenen\u00e9 spr\u00e1vanie direkt\u00edvy \u201eLimitRequestFields\u201c v mod_http2, nastavenie hodnoty 0 teraz vyp\u00edna obmedzenie.\n<li class=\"l\"> V mod_http2 bola zabezpe\u010den\u00e1 manipul\u00e1cia s prim\u00e1rnymi a sekund\u00e1rnymi (master\/secondary) spojeniami a ozna\u010denie met\u00f3d v z\u00e1vislosti od pou\u017eitia.\n<li class=\"l\"> Pri prijat\u00ed nespr\u00e1vneho obsahu hlavi\u010dky Last-Modified zo skriptu FCGI\/CGI sa teraz t\u00e1to hlavi\u010dka odstra\u0148uje, a nie nahr\u00e1dza za epoch\u00e1lny \u010das (Unix epoch).\n<li class=\"l\"> Do k\u00f3du bola pridan\u00e1 funkcia ap_parse_strict_length() na pr\u00edsne parsovanie ve\u013ekosti obsahu.\n<li class=\"l\"> V mod_proxy_fcgi  v ProxyFCGISetEnvIf bolo zabezpe\u010den\u00e9 odstr\u00e1nenie premenn\u00fdch prostredia, ak dan\u00fd v\u00fdraz vr\u00e1ti False.\n<li class=\"l\"> Opraveno stavy z\u00e1vodu a mo\u017en\u00fd p\u00e1d mod_ssl p\u0159i pou\u017eit\u00ed klientsk\u00e9ho certifik\u00e1tu nastaven\u00e9ho prost\u0159ednictv\u00edm parametru SSLProxyMachineCertificateFile.\n<li class=\"l\"> Vy\u0159e\u0161ena \u00fanik pam\u011bti v mod_ssl.\n<li class=\"l\"> V mod_proxy_http2 bolo zabezpe\u010den\u00e9 pou\u017eitie parametra proxy \u201e<noindex><a rel=\"nofollow\" href=\"https:\/\/httpd.apache.org\/docs\/2.4\/mod\/mod_proxy.html\">ping<\/a><\/noindex>\u201e pri kontrole funk\u010dnosti nov\u00e9ho alebo znovu pou\u017eit\u00e9ho spojenia s backendom.\n<li class=\"l\"> Preukonan\u00e9 je viazanie httpd s mo\u017enos\u0165ou \u201e-lsystemd\u201c, ak je aktivovan\u00fd mod_systemd.\n<li class=\"l\"> V mod_proxy_http2 byl zohledn\u011bn parametr ProxyTimeout p\u0159i \u010dek\u00e1n\u00ed na p\u0159\u00edchoz\u00ed data p\u0159es spojen\u00ed s backendem.\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Zdroj: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=53517\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.46 (\u0432\u044b\u043f\u0443\u0441\u043a\u0438 2.4.44 \u0438 2.4.45 \u0431\u044b\u043b\u0438 \u043f\u0440\u043e\u043f\u0443\u0449\u0435\u043d\u044b), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e 17 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 3 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: CVE-2020-11984 &#8212; \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 mod_proxy_uwsgi, \u043a\u043e\u0442\u043e\u0440\u043e\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043f\u0440\u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0443 \u043e\u0447\u0435\u043d\u044c \u0434\u043b\u0438\u043d\u043d\u043e\u0433\u043e HTTP-\u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430. \u0414\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0430 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-91158","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.5 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.46 (\u0432\u044b\u043f\u0443\u0441\u043a\u0438 2.4.44 \u0438 2.4.45 \u0431\u044b\u043b\u0438 \u043f\u0440\u043e\u043f\u0443\u0449\u0435\u043d\u044b), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/news\/reliz-http-servera-apache-2-4-46-s-ustraneniem-uyazvimostej\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.5\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.46 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.46 (\u0432\u044b\u043f\u0443\u0441\u043a\u0438 2.4.44 \u0438 2.4.45 \u0431\u044b\u043b\u0438 \u043f\u0440\u043e\u043f\u0443\u0449\u0435\u043d\u044b), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/news\/reliz-http-servera-apache-2-4-46-s-ustraneniem-uyazvimostej\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-08-08T23:43:01+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-08-08T23:43:01+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vyd\u00e1n\u00ed http serveru Apache 2.4.46 s odstran\u011bn\u00edm zranitelnost\u00ed | ProHoster","description":"Bylo vyd\u00e1no vyd\u00e1n\u00ed HTTP serveru Apache 2.4.46 (verze 2.4.44 a 2.4.45 byly p\u0159esko\u010deny), kter\u00e9 obsahuje.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/reliz-http-servera-apache-2-4-46-s-ustraneniem-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.46 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.46 (\u0432\u044b\u043f\u0443\u0441\u043a\u0438 2.4.44 \u0438 2.4.45 \u0431\u044b\u043b\u0438 \u043f\u0440\u043e\u043f\u0443\u0449\u0435\u043d\u044b), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/reliz-http-servera-apache-2-4-46-s-ustraneniem-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-08T23:43:01+00:00","article:modified_time":"2020-08-08T23:43:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91158","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:33:24","updated":"2022-09-28 03:36:52","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/91158","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=91158"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/91158\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=91158"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=91158"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=91158"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}