{"id":103543,"date":"2022-03-15T09:37:16","date_gmt":"2022-03-15T07:37:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-http-servera-apache-2-4-53-s-ustraneniem-opasnyh-uyazvimostej"},"modified":"2022-03-15T09:37:16","modified_gmt":"2022-03-15T07:37:16","slug":"reliz-http-servera-apache-2-4-53-s-ustraneniem-opasnyh-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/reliz-http-servera-apache-2-4-53-s-ustraneniem-opasnyh-uyazvimostej","title":{"rendered":"Lan\u00e7imi i serverit http Apache 2.4.53 me rregullime p\u00ebr dob\u00ebsi t\u00eb rrezikshme","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
\u00cbsht\u00eb publikuar lansimi i serverit HTTP Apache 2.4.53, i cili p\u00ebrmban 14 ndryshime dhe ka eliminuar 4 dob\u00ebsi: <\/p>\n
\n
CVE-2022-22720 — mund\u00ebsia p\u00ebr t\u00eb kryer nj\u00eb sulm «HTTP Request Smuggling», i cili lejon, p\u00ebrmes d\u00ebrgimit t\u00eb k\u00ebrkesave t\u00eb klient\u00ebve t\u00eb formuara posa\u00e7\u00ebrisht, p\u00ebr t\u00eb nd\u00ebrhyr\u00eb n\u00eb p\u00ebrmbajtjen e k\u00ebrkesave t\u00eb p\u00ebrdoruesve t\u00eb tjer\u00eb, t\u00eb cilat transmetohen p\u00ebrmes mod_proxy (p\u00ebr shembull, mund t\u00eb arrihet futja e kodit JavaScript t\u00eb d\u00ebmsh\u00ebm n\u00eb seanc\u00ebn e nj\u00eb p\u00ebrdoruesi tjet\u00ebr t\u00eb faqes). Problemi shkaktohet nga l\u00ebnia e lidhjeve hyr\u00ebse t\u00eb hapura pas shfaqjes s\u00eb gabimeve gjat\u00eb p\u00ebrpunimit t\u00eb trupit t\u00eb pap\u00ebrshtatsh\u00ebm t\u00eb k\u00ebrkes\u00ebs.\n
CVE-2022-23943 — mbushja e tamponit n\u00eb modulin mod_sed, e cila lejon mbishkrimin e p\u00ebrmbajtjes s\u00eb memories heap me t\u00eb dh\u00ebna t\u00eb kontrolluara nga sulmuesi.\n
CVE-2022-22721 — mund\u00ebsia p\u00ebr t\u00eb shkruar p\u00ebrtej tamponit p\u00ebr shkak t\u00eb mbushjes s\u00eb numrit t\u00eb plot\u00eb, q\u00eb ndodh gjat\u00eb d\u00ebrgimit t\u00eb trupit t\u00eb k\u00ebrkes\u00ebs me nj\u00eb madh\u00ebsi m\u00eb shum\u00eb se 350MB. Problemi shfaqet n\u00eb sistemet 32-bit ku \u00ebsht\u00eb caktuar nj\u00eb vler\u00eb shum\u00eb e lart\u00eb p\u00ebr LimitXMLRequestBody (me shkall\u00ebzimin standard 1 MB, p\u00ebr sulmin limiti duhet t\u00eb jet\u00eb m\u00eb i lart\u00eb se 350 MB).\n
CVE-2022-22719 — nj\u00eb vulnerabilitet n\u00eb mod_lua q\u00eb mund\u00ebson leximin e zonave t\u00eb rast\u00ebsishme t\u00eb memories dhe prishjen e procesit gjat\u00eb p\u00ebrpunimit t\u00eb trupit t\u00eb k\u00ebrkes\u00ebs s\u00eb dizajnuar ve\u00e7mas. Problemi shkaktohet nga p\u00ebrdorimi i vlerave t\u00eb pa inicializuara n\u00eb kodin e funksionit r:parsebody. <\/ul>\n
Ndryshimet m\u00eb t\u00eb dukshme, t\u00eb pad\u00ebshiruara nga siguria: <\/p>\n
\n
N\u00eb mod_proxy \u00ebsht\u00eb rritur kufiri i karaktereve n\u00eb emrin e p\u00ebrpunuesit (worker). Shtuar mund\u00ebsia p\u00ebr konfigurimin selektiv t\u00eb koh\u00ebve t\u00eb skadimit p\u00ebr backend dhe frontend (p\u00ebr shembull, lidhur me worker-in). P\u00ebr k\u00ebrkesat q\u00eb kalojn\u00eb p\u00ebrmes websockets ose metod\u00ebs CONNECT, koha e skadimit \u00ebsht\u00eb vendosur n\u00eb vler\u00ebn maksimale t\u00eb caktuar p\u00ebr backend dhe frontend.\n
P\u00ebrpunimi i hapjes s\u00eb skedar\u00ebve DBM dhe ngarkimi i drejtuesit DBM jan\u00eb ndar\u00eb. N\u00eb rast t\u00eb d\u00ebshtimit, tani shfaqen detaje m\u00eb t\u00eb holl\u00ebsishme mbi gabimin dhe drejtuesin n\u00eb log.\n