{"id":103543,"date":"2022-03-15T09:37:16","date_gmt":"2022-03-15T07:37:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-http-servera-apache-2-4-53-s-ustraneniem-opasnyh-uyazvimostej"},"modified":"2022-03-15T09:37:16","modified_gmt":"2022-03-15T07:37:16","slug":"reliz-http-servera-apache-2-4-53-s-ustraneniem-opasnyh-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/reliz-http-servera-apache-2-4-53-s-ustraneniem-opasnyh-uyazvimostej","title":{"rendered":"L\u00ebshimi i serverit http Apache 2.4.53 me rregullimin e dob\u00ebsive t\u00eb rrezikshme","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
\u00cbsht\u00eb publikuar l\u00ebshimi i serverit HTTP Apache 2.4.53, i cili ka p\u00ebrfshir\u00eb 14 ndryshime dhe ka rregulluar 4 dob\u00ebsi: <\/p>\n
\n
CVE-2022-22720 \u2014 mund\u00ebsia p\u00ebr t\u00eb kryer nj\u00eb sulm \u2018HTTP Request Smuggling\u2019, i cili lejon p\u00ebrmes d\u00ebrgimit t\u00eb k\u00ebrkesave t\u00eb klient\u00ebve t\u00eb formatuara n\u00eb m\u00ebnyr\u00eb t\u00eb ve\u00e7ant\u00eb t\u00eb infiltron n\u00eb p\u00ebrmbajtjen e k\u00ebrkesave t\u00eb p\u00ebrdoruesve t\u00eb tjer\u00eb, q\u00eb kalojn\u00eb p\u00ebrmes mod_proxy (p\u00ebr shembull, mund t\u00eb arrihet futja e kodit JavaScript t\u00eb d\u00ebmsh\u00ebm n\u00eb seanc\u00ebn e nj\u00eb p\u00ebrdoruesi tjet\u00ebr t\u00eb faqes). Problemi shkaktohet nga l\u00ebnia e lidhjeve hyr\u00ebse t\u00eb hapura pas shfaqjes s\u00eb gabimeve gjat\u00eb p\u00ebrpunimit t\u00eb trupit t\u00eb k\u00ebrkes\u00ebs jo t\u00eb sakt\u00eb.\n
CVE-2022-23943 \u2014 mbushje buffer n\u00eb modul\u00ebn mod_sed, e cila lejon rishkrimin e p\u00ebrmbajtjes s\u00eb memories heap me t\u00eb dh\u00ebna q\u00eb kontrollohen nga sulmuesi.\n
CVE-2022-22721 \u2014 mund\u00ebsia p\u00ebr t\u00eb shkruar p\u00ebrtej kufijve t\u00eb buffer-it p\u00ebr shkak t\u00eb mbushjes s\u00eb numrave q\u00eb ndodh gjat\u00eb d\u00ebrgimit t\u00eb trupit t\u00eb k\u00ebrkes\u00ebs m\u00eb t\u00eb madhe se 350MB. Problemi shfaqet n\u00eb sistemet 32-bit me nj\u00eb vler\u00eb tep\u00ebr t\u00eb lart\u00eb t\u00eb LimitXMLRequestBody (p\u00ebr default 1MB, p\u00ebr sulm, kufiri duhet t\u00eb jet\u00eb m\u00eb i lart\u00eb se 350MB).\n
CVE-2022-22719 \u2014 nj\u00eb dob\u00ebsi n\u00eb mod_lua, e cila lejon leximin e zonave t\u00eb rastit t\u00eb memories dhe rr\u00ebzimin e procesit gjat\u00eb p\u00ebrpunimit t\u00eb trupit t\u00eb k\u00ebrkes\u00ebs t\u00eb formatuar n\u00eb m\u00ebnyr\u00eb t\u00eb ve\u00e7ant\u00eb. Problemi shkaktohet nga p\u00ebrdorimi i vlerave t\u00eb pap\u00ebrcaktuara n\u00eb kodin e funksionit r:parsebody. <\/ul>\n
Ndryshimet m\u00eb t\u00eb dukshme, q\u00eb nuk lidhen me sigurin\u00eb: <\/p>\n
\n
N\u00eb mod_proxy \u00ebsht\u00eb rritur limiti p\u00ebr numrin e simboleve n\u00eb emrin e p\u00ebrpunuesit (worker). \u00cbsht\u00eb shtuar mund\u00ebsia p\u00ebr konfiguruar ve\u00e7mas koh\u00ebt e skadimit p\u00ebr backend dhe frontend (p\u00ebr shembull, n\u00eb lidhje me worker). P\u00ebr k\u00ebrkesat q\u00eb transmetohen p\u00ebrmes websockets ose metod\u00ebs CONNECT, koha e skadimit \u00ebsht\u00eb ndryshuar n\u00eb vler\u00ebn maksimale q\u00eb \u00ebsht\u00eb caktuar p\u00ebr backend dhe frontend.\n
\u00cbsht\u00eb ndar\u00eb p\u00ebrpunimi i hapjes s\u00eb skedar\u00ebve DBM dhe ngarkimit t\u00eb drejtuesit DBM. N\u00eb rast d\u00ebshtimi n\u00eb log tani shfaqen informacione m\u00eb t\u00eb detajuara p\u00ebr gabimin dhe drejtuesin.\n