Apache 2.4.46 ื”ื˜ื˜ืคึผ ืกืขืจื•ื•ืขืจ ืžืขืœื“ื•ื ื’ ืžื™ื˜ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ื– ืคืึทืจืคืขืกื˜ื™ืงื˜

ืืจื•ื™ืก ืžืขืœื“ื•ื ื’ ืคื•ืŸ ื“ื™ ืึทืคึผืึทื˜ืฉื™ ื”ื˜ื˜ืคึผ ืกืขืจื•ื•ืขืจ 2.4.46 (ืจื™ืœื™ืกื™ื– 2.4.44 ืื•ืŸ 2.4.45 ื–ืขื ืขืŸ ืกืงื™ืคึผื˜), ื•ื•ืึธืก ื™ื ื˜ืจืึธื•ื“ื•ืกื˜ 17 ืขื ื“ืขืจื•ื ื’ืขืŸ ืื•ืŸ ื™ืœื™ืžืึทื ื™ื™ื˜ืึทื“ 3 ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ื–:

  • CVE-2020-11984 - ืึท ื‘ืึทืคืขืจ ืึธื•ื•ื•ืขืจืคืœืึธื• ืื™ืŸ ื“ื™ mod_proxy_uwsgi ืžืึธื“ื•ืœืข, ื•ื•ืึธืก ืงืขื ืขืŸ ืคื™ืจืŸ ืฆื• ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข ืœื™ืงืึทื“ื–ืฉ ืึธื“ืขืจ ืงืึธื“ ื“ื•ืจื›ืคื™ืจื•ื ื’ ืื•ื™ืฃ ื“ื™ ืกืขืจื•ื•ืขืจ ื•ื•ืขืŸ ืื™ืจ ืฉื™ืงืŸ ืึท ืกืคึผืขืฆื™ืขืœ ืงืจืึทืคื˜ืขื“ ื‘ืขื˜ืŸ. ื“ื™ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ ืื™ื– ืขืงืกืคึผืœื•ื™ื˜ืึทื“ ื“ื•ืจืš ืฉื™ืงืŸ ืึท ื–ื™ื™ืขืจ ืœืึทื ื’ ื”ื˜ื˜ืคึผ ื›ืขื“ืขืจ. ืคึฟืึทืจ ืฉื•ืฅ, ื‘ืœืึทืงื™ื ื’ ืคื•ืŸ ื›ืขื“ืขืจื– ืžืขืจ ื•ื•ื™ 16 ืง ืื™ื– ืฆื•ื’ืขื’ืขื‘ืŸ (ืึท ืฉื™ืขื•ืจ ื“ื™ืคื™ื™ื ื“ ืื™ืŸ ื“ื™ ืคึผืจืึธื˜ืึธืงืึธืœ ื‘ืึทืฉืจื™ื™ึทื‘ื•ื ื’).
  • CVE-2020-11993 - ืึท ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ ืื™ืŸ ื“ื™ ืžืึธื“_ื”ื˜ื˜ืคึผ 2 ืžืึธื“ื•ืœืข ื•ื•ืึธืก ืึทืœืึทื•ื– ื“ืขื ืคึผืจืึธืฆืขืก ืฆื• ืงืจืึทืš ื•ื•ืขืŸ ืื™ืจ ืฉื™ืงืŸ ืึท ื‘ืงืฉื” ืžื™ื˜ ืึท ืกืคึผืขืฆื™ืขืœ ื“ื™ื–ื™ื™ื ื“ ื”ื˜ื˜ืคึผ / 2 ื›ืขื“ืขืจ. ื“ืขืจ ืคึผืจืึธื‘ืœืขื ืžืึทื ืึทืคืขืกืฅ ื–ื™ืš ื•ื•ืขืŸ ื“ื™ื‘ืึทื’ื™ื ื’ ืึธื“ืขืจ ื˜ืจื™ื™ืกื™ื ื’ ืื™ื– ืขื ื™ื™ื‘ืึทืœื“ ืื™ืŸ ื“ื™ ืžืึธื“_ื”ื˜ื˜ืคึผ2 ืžืึธื“ื•ืœืข ืื•ืŸ ืื™ื– ืฉืคื™ื’ืœื˜ ืื™ืŸ ื–ื™ืงืึธืจืŸ ืื™ื ื”ืึทืœื˜ ืงืึธืจื•ืคึผืฆื™ืข ืจืขื›ื˜ ืฆื• ืึท ืจืึทืกืข ืฆื•ืฉื˜ืึทื ื“ ื•ื•ืขืŸ ืฉืคึผืึธืจืŸ ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข ืฆื• ื“ื™ ืงืœืึธืฅ. ื“ืขืจ ืคึผืจืึธื‘ืœืขื ืงืขืŸ ื ื™ืฉื˜ ื“ืขืจืฉื™ื™ึทื ืขืŸ ื•ื•ืขืŸ LogLevel ืื™ื– ื‘ืึทืฉื˜ื™ืžื˜ ืฆื• "ืื™ื ืคึฟืึธืจืžืึทืฆื™ืข".
  • CVE-2020-9490 - ืึท ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ ืื™ืŸ ื“ื™ ืžืึธื“_ื”ื˜ื˜ืคึผ 2 ืžืึธื“ื•ืœืข ื•ื•ืึธืก ืึทืœืึทื•ื– ืึท ืคึผืจืึธืฆืขืก ืฆื• ืงืจืึทืš ื•ื•ืขืŸ ืื™ืจ ืฉื™ืงืŸ ืึท ื‘ืงืฉื” ื“ื•ืจืš ื”ื˜ื˜ืคึผ / 2 ืžื™ื˜ ืึท ืกืคึผืขืฉืœื™ ื“ื™ื–ื™ื™ื ื“ 'Cache-Digest' ื›ืขื“ืขืจ ื•ื•ืขืจื˜ (ื“ืขืจ ืงืจืึทืš ืึทืงืขืจื– ื•ื•ืขืŸ ืื™ืจ ืคึผืจื•ื‘ื™ืจืŸ ืฆื• ื“ื•ืจื›ืคื™ืจืŸ ืึท HTTP / 2 PUSH ืึธืคึผืขืจืึทืฆื™ืข ืื•ื™ืฃ ืึท ืžื™ื˜ืœ) . ืฆื• ืคืึทืจืฉืคึผืึทืจืŸ ื“ื™ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™, ืื™ืจ ืงืขื ืขืŸ ื ื•ืฆืŸ ื“ื™ "H2Push off" ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ.
  • CVE-2020-11985 - mod_remoteip ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™, ื•ื•ืึธืก ืึทืœืึทื•ื– ืื™ืจ ืฆื• ืฉื•ื•ื™ื ื“ืœ IP ืึทื“ืจืขืกืขืก ื‘ืขืฉืึทืก ืคึผืจืึทืงืกื™ื™ื ื’ ื ื™ืฆืŸ mod_remoteip ืื•ืŸ mod_rewrite. ื“ืขืจ ืคึผืจืึธื‘ืœืขื ืื™ื– ื‘ืœื•ื™ื– ืคึฟืึทืจ ืจื™ืœื™ืกื™ื– 2.4.1 ืฆื• 2.4.23.

ื“ื™ ืžืขืจืกื˜ ื ืึธื•ื˜ืึทื‘ืึทืœ ื ื™ื˜-ื–ื™ื›ืขืจื”ื™ื™ื˜ ืขื ื“ืขืจื•ื ื’ืขืŸ ื–ืขื ืขืŸ:

  • ืฉื˜ื™ืฆืŸ ืคึฟืึทืจ ืคึผืœืึทืŸ ื‘ืึทืฉืจื™ื™ึทื‘ื•ื ื’ ืื™ื– ืึทื•ื•ืขืงื’ืขื ื•ืžืขืŸ ืคื•ืŸ ืžืึธื“_ื”ื˜ื˜ืคึผ2 ืงืึทื–ื•ื”ืึธ-ื”2-ืงืึทืฉ-ืงื™ืฆืขืจ, ื•ื•ืขืžืขื  ืก ืคืืจืฉืคืจื™ื™ื˜ื•ื ื’ ืื™ื– ืืคื’ืขืฉื˜ืขืœื˜ ื’ืขื•ื•ืืจืŸ.
  • ื˜ืฉื™ื™ื ื“ื–ืฉื“ ื“ื™ ื ืึทื˜ื•ืจ ืคื•ืŸ ื“ื™ "ืœื™ืžื™ื˜ืจืขืงื•ื•ืขืกื˜ืคื™ืขืœื“ืก" ื“ื™ืจืขืงื˜ื™ื•ื• ืื™ืŸ ืžืึธื“_ื”ื˜ื˜ืคึผ2; ืกืคึผืขืฆื™ืคื™ืฆื™ืจืŸ ืึท ื•ื•ืขืจื˜ ืคื•ืŸ 0 ืื™ืฆื˜ ื“ื™ืกื™ื™ื‘ืึทืœื– ื“ื™ ืฉื™ืขื•ืจ.
  • ืžืึธื“_ื”ื˜ื˜ืคึผ2 ื’ื™ื˜ ืคึผืจืึทืกืขืกื™ื ื’ ืคื•ืŸ ืขืจืฉื˜ื™ืง ืื•ืŸ ืฆื•ื•ื™ื™ื˜ื™ืง (ื‘ืขืœ / ืฆื•ื•ื™ื™ื˜ื™ืง) ืงืึทื ืขืงืฉืึทื ื– ืื•ืŸ ืžืึทืจืงื™ื ื’ ืคื•ืŸ ืžืขื˜ื”ืึธื“ืก ื“ื™ืคึผืขื ื“ื™ื ื’ ืื•ื™ืฃ ื ื•ืฆืŸ.
  • ืื•ื™ื‘ ื“ื™ ืื•ืžืจืขื›ื˜ ืื™ื ื”ืึทืœื˜ ืคื•ืŸ ื“ื™ ืœืขืฆื˜ืข ืžืึธื“ื™ืคื™ืขื“ ื›ืขื“ืขืจ ืื™ื– ื‘ืืงื•ืžืขืŸ ืคื•ืŸ ืึท FCGI / CGI ืฉืจื™ืคื˜, ื“ืขื ื›ืขื“ืขืจ ืื™ื– ืื™ืฆื˜ ืึทื•ื•ืขืงื’ืขื ื•ืžืขืŸ ืืœื ื•ื•ื™ ืจื™ืคึผืœื™ื™ืกื˜ ืื™ืŸ ื™ื•ื ื™ืงืก ืขืคึผืึธืก ืฆื™ื™ื˜.
  • ื“ื™ ap_parse_strict_length () ืคึฟื•ื ืงืฆื™ืข ืื™ื– ืฆื•ื’ืขืœื™ื™ื’ื˜ ืฆื• ื“ื™ ืงืึธื“ ืฆื• ืฉื˜ืจืขื ื’ ืคึผืึทืจืกื™ืจืŸ ื“ื™ ืื™ื ื”ืึทืœื˜ ื’ืจื™ื™ืก.
  • Mod_proxy_fcgi's ProxyFCGISetEnvIf ื™ื ืฉื•ืจื– ืึทื– ืกื•ื•ื™ื•ื•ืข ื•ื•ืขืจื™ืึทื‘ืึทืœื– ื–ืขื ืขืŸ ืึทื•ื•ืขืงื’ืขื ื•ืžืขืŸ ืื•ื™ื‘ ื“ืขืจ ื’ืขื’ืขื‘ืŸ ืื•ื™ืกื“ืจื•ืง ืงืขืจื˜ ืคืึทืœืฉ.
  • ืคืึทืจืคืขืกื˜ื™ืงื˜ ืึท ืจืึทืกืข ืฆื•ืฉื˜ืึทื ื“ ืื•ืŸ ืžืขื’ืœืขืš ืžืึธื“_ืกืกืœ ืงืจืึทืš ื•ื•ืขืŸ ื ื™ืฆืŸ ืึท ืงืœื™ืขื ื˜ ื‘ืึทื•ื•ื™ื™ึทื–ืŸ ืกืคึผืขืกื™ืคื™ืขื“ ื“ื•ืจืš ื“ื™ SSLProxyMachineCertificateFile ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ.
  • ืคืึทืจืคืขืกื˜ื™ืงื˜ ื–ื›ึผืจื•ืŸ ืจื™ื ืขืŸ ืื™ืŸ mod_ssl.
  • mod_proxy_http2 ื’ื™ื˜ ื“ื™ ื ื•ืฆืŸ ืคื•ืŸ ื“ื™ ืคึผืจืึทืงืกื™ ืคึผืึทืจืึทืžืขื˜ืขืจ "ืคึผื™ื ื’ยป ื•ื•ืขืŸ ืงืึธื ื˜ืจืึธืœื™ืจืŸ ื“ื™ ืคืึทื ื’ืงืฉืึทื ืึทืœื™ื˜ื™ ืคื•ืŸ ืึท ื ื™ื™ึทืข ืึธื“ืขืจ ืจื™ื•ื–ื“ ืงืฉืจ ืฆื• ื“ื™ ื‘ืึทืงืขื ื“.
  • ืคืืจืฉื˜ืืคื˜ ื‘ื™ื™ื ื“ื™ื ื’ ื”ื˜ื˜ืคึผื“ ืžื™ื˜ ื“ื™ "-ืœืกื™ืกื˜ืขืžื“" ืึธืคึผืฆื™ืข ื•ื•ืขืŸ ืžืึธื“_ืกื™ืกื˜ืขืžื“ ืื™ื– ืขื ื™ื™ื‘ืึทืœื“.
  • ืžืึธื“_ืคึผืจืึธืงืกื™_ื”ื˜ื˜ืคึผ2 ื™ื ืฉื•ืจื– ืึทื– ื“ื™ ProxyTimeout ื‘ืึทืฉื˜ืขื˜ื™ืงืŸ ืื™ื– ื’ืขื ื•ืžืขืŸ ืื™ืŸ ื—ืฉื‘ื•ืŸ ื•ื•ืขืŸ ื•ื•ืืจื˜ืŸ ืคึฟืึทืจ ื™ื ืงืึทืžื™ื ื’ ื“ืึทื˜ืŸ ื“ื•ืจืš ืงืึทื ืขืงืฉืึทื ื– ืฆื• ื“ื™ ื‘ืึทืงืขื ื“.

ืžืงื•ืจ: opennet.ru

ืœื™ื™ื’ืŸ ืึท ื‘ืึทืžืขืจืงื•ื ื’