{"id":102701,"date":"2021-12-22T09:36:38","date_gmt":"2021-12-22T07:36:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/reliz-http-servera-apache-2-4-52-s-ustraneniem-perepolneniya-bufera-v-mod_lua"},"modified":"2021-12-22T09:36:38","modified_gmt":"2021-12-22T07:36:38","slug":"reliz-http-servera-apache-2-4-52-s-ustraneniem-perepolneniya-bufera-v-mod_lua","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/reliz-http-servera-apache-2-4-52-s-ustraneniem-perepolneniya-bufera-v-mod_lua","title":{"rendered":"Release av HTTP-servern Apache 2.4.52 som \u00e5tg\u00e4rdar en buffer overflow i mod_lua","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Utg\u00e5van av HTTP-servern Apache 2.4.52 har publicerats, med 25 f\u00f6r\u00e4ndringar och 2 s\u00e5rbarheter \u00e5tg\u00e4rdade:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2021-44790 \u2014 en buffert\u00f6mningsfel i mod_lua, som upptr\u00e4der vid analys av f\u00f6rfr\u00e5gningar som best\u00e5r av flera delar (multipart). S\u00e5rbarheten ber\u00f6r konfigurationer d\u00e4r Lua-skript anropar funktionen r:parsebody() f\u00f6r att analysera kroppsdatan i f\u00f6rfr\u00e5gan och till\u00e5ter en angripare att \u00e5stadkomma buffert\u00f6mningsfel genom att skicka en specialdesignad f\u00f6rfr\u00e5gan. Det finns \u00e4nnu inga bevis p\u00e5 exploatering, men problemet kan potentiellt leda till utf\u00f6rande av egen kod p\u00e5 <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/sv\/server\/dts-newyork\/\"   title=\"servern\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2693\">servern<\/a>.\n<li class=\"l\"> CVE-2021-44224 \u2014 en SSRF-s\u00e5rbarhet (Server Side Request Forgery) i mod_proxy, som g\u00f6r det m\u00f6jligt, i konfigurationer med inst\u00e4llningen \u201eProxyRequests on\u201d, att genom en specialdesignad URI omdirigera f\u00f6rfr\u00e5gan till en annan hanterare p\u00e5 samma server som tar emot anslutningar via Unix Domain Socket. Problemet kan ocks\u00e5 anv\u00e4ndas f\u00f6r att \u00e5stadkomma krasch genom att skapa f\u00f6rh\u00e5llanden f\u00f6r dereferering av en nullpekare. Problemet ber\u00f6r versioner av Apache httpd fr\u00e5n och med version 2.4.7.    <\/ul>\n<p>De mest m\u00e4rkbara f\u00f6r\u00e4ndringarna, orelaterade till s\u00e4kerhet:   <\/p>\n<ul>\n<li class=\"l\"> St\u00f6det f\u00f6r kompilering med OpenSSL 3-biblioteket har lagts till i mod_ssl.\n<li class=\"l\"> F\u00f6rb\u00e4ttrad detektering av OpenSSL-biblioteket i autoconf-skript.\n<li class=\"l\"> I mod_proxy f\u00f6r tunnelingprotokoll har m\u00f6jlighet att inaktivera omdirigering av halv\u00f6ppna (half-close) TCP-anslutningar inf\u00f6rts genom att st\u00e4lla in parametern \u201eSetEnv proxy-nohalfclose\u201d.\n<li class=\"l\"> Ytterligare kontroller har lagts till f\u00f6r att s\u00e4kerst\u00e4lla att URI:er som inte \u00e4r avsedda f\u00f6r proxying inneh\u00e5ller en http\/https-scheman, medan de som \u00e4r avsedda f\u00f6r proxying inneh\u00e5ller ett v\u00e4rdnamn.\n<li class=\"l\"> I mod_proxy_connect och mod_proxy \u00e4r det f\u00f6rbjudet att \u00e4ndra statuskoden efter att den har skickats till klienten.\n<li class=\"l\"> Vid s\u00e4ndning av mellanliggande svar efter att ha mottagit f\u00f6rfr\u00e5gningar med rubriken \u201eExpect: 100-Continue\u201d s\u00e4kerst\u00e4lls att resultatet anger tillst\u00e5ndet \u201e100 Continue\u201d ist\u00e4llet f\u00f6r det aktuella tillst\u00e5ndet av f\u00f6rfr\u00e5gan.\n<li class=\"l\"> I mod_dav har st\u00f6d lagts till f\u00f6r CalDAV-till\u00e4gg, d\u00e4r egenskaper vid generering m\u00e5ste beakta b\u00e5de dokumentelement och egenselement. Nya funktioner som dav_validate_root_ns(), dav_find_child_ns(), dav_find_next_ns(), dav_find_attr_ns() och dav_find_attr() har lagts till, vilka kan anropas fr\u00e5n andra moduler.\n<li class=\"l\"> I mpm_event har problemet med stoppande av vilande barnprocesser efter en \u00f6kning av belastningen p\u00e5 servern \u00e5tg\u00e4rdats.\n<li class=\"l\"> I mod_http2 har regressiva \u00e4ndringar som orsakar felaktigt beteende vid hantering av begr\u00e4nsningarna MaxRequestsPerChild och MaxConnectionsPerChild \u00e5tg\u00e4rdats.\n<li class=\"l\"> M\u00f6jligheterna f\u00f6r modulen mod_md, som anv\u00e4nds f\u00f6r automatisering av certifikatinh\u00e4mtning och underh\u00e5ll med hj\u00e4lp av protokollet ACME (Automatic Certificate Management Environment), har utvidgats:\n<ul>\n<li class=\"l\"> St\u00f6d f\u00f6r mekanismen ACME External Account Binding (EAB) har lagts till och aktiveras med direktivet MDExternalAccountBinding. V\u00e4rden f\u00f6r EAB kan konfigureras fr\u00e5n en extern fil i JSON-format, vilket g\u00f6r det m\u00f6jligt att inte avsl\u00f6ja autentiseringsparametrar i huvudfilen. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/sv\/server\/\"   title=\"serverkonfigurationen\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"997\">serverkonfigurationen<\/a>.\n<li class=\"l\"> I direktivet 'MDCertificateAuthority' s\u00e4kerst\u00e4lls att det anges en URL med http\/https eller ett av de f\u00f6rdefinierade namnen ('LetsEncrypt', 'LetsEncrypt-Test', 'Buypass' och 'Buypass-Test').\n<li class=\"l\">  Angivelsen av direktivet MDContactEmail \u00e4r till\u00e5ten inom sektionen .\n<li class=\"l\"> Flera fel har \u00e5tg\u00e4rdats, inklusive en minnesl\u00e4cka som intr\u00e4ffade vid problem vid inl\u00e4sning av privat nyckel.  <\/ul>\n<\/ul>\n<p>K\u00e4lla: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=56387\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.52, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e 25 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b 2 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: CVE-2021-44790 &#8212; \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 mod_lua, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0435\u0435\u0441\u044f \u043f\u0440\u0438 \u0440\u0430\u0437\u0431\u043e\u0440\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432, \u0441\u043e\u0441\u0442\u043e\u044f\u0449\u0438\u0445 \u0438\u0437 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0447\u0430\u0441\u0442\u0435\u0439 (multipart). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 Lua-\u0441\u043a\u0440\u0438\u043f\u0442\u044b \u0432\u044b\u0437\u044b\u0432\u0430\u044e\u0442 \u0444\u0443\u043d\u043a\u0446\u0438\u044e r:parsebody() \u0434\u043b\u044f \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0442\u0435\u043b\u0430 \u0437\u0430\u043f\u0440\u043e\u0441\u0430, \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430. \u0424\u0430\u043a\u0442\u043e\u0432 \u043d\u0430\u043b\u0438\u0447\u0438\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102701","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.52, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e 25 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b 2 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: CVE-2021-44790 - \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 mod_lua, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0435\u0435\u0441\u044f \u043f\u0440\u0438 \u0440\u0430\u0437\u0431\u043e\u0440\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sv\/blog\/news\/reliz-http-servera-apache-2-4-52-s-ustraneniem-perepolneniya-bufera-v-mod_lua\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sv_SE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.52 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 mod_lua | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.52, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e 25 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b 2 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: CVE-2021-44790 - \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 mod_lua, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0435\u0435\u0441\u044f \u043f\u0440\u0438 \u0440\u0430\u0437\u0431\u043e\u0440\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sv\/blog\/news\/reliz-http-servera-apache-2-4-52-s-ustraneniem-perepolneniya-bufera-v-mod_lua\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-12-22T07:36:38+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-12-22T07:36:38+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Release av HTTP-servern Apache 2.4.52 med \u00e5tg\u00e4rd av buffert\u00f6versv\u00e4mning i mod_lua | ProHoster","description":"Versionen av HTTP-servern Apache 2.4.52 har publicerats, vilket inneh\u00e5ller 25 \u00e4ndringar och \u00e5tg\u00e4rdar 2 s\u00e5rbarheter: CVE-2021-44790 - buffert\u00f6versv\u00e4mning i mod_lua, vilket uppst\u00e5r vid analys av f\u00f6rfr\u00e5gningar.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/reliz-http-servera-apache-2-4-52-s-ustraneniem-perepolneniya-bufera-v-mod_lua","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0435\u043b\u0438\u0437 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.52 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 mod_lua | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0440\u0435\u043b\u0438\u0437 HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.52, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e 25 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b 2 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: CVE-2021-44790 - \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 mod_lua, \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0449\u0435\u0435\u0441\u044f \u043f\u0440\u0438 \u0440\u0430\u0437\u0431\u043e\u0440\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/reliz-http-servera-apache-2-4-52-s-ustraneniem-perepolneniya-bufera-v-mod_lua","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-12-22T07:36:38+00:00","article:modified_time":"2021-12-22T07:36:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102701","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-12-22 07:36:51","updated":"2026-02-09 21:39:49","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/102701","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=102701"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/102701\/revisions"}],"predecessor-version":[{"id":159973,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/102701\/revisions\/159973"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=102701"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=102701"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=102701"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}