Security release!
-
moderate: Apache HTTP Server: HTTP response splitting ( CVE-2023-38709)
-
Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses.
This issue affects Apache HTTP Server: through 2.4.58.
Acknowledgements: finder: Orange Tsai (@orange_8361) from DEVCORE
Reported to security team 2023-06-26 Update 2.4.59 released 2024-04-04 Affects <=2.4.58 -
low: Apache HTTP Server: HTTP Response Splitting in multiple modules ( CVE-2024-24795)
-
HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack.
Users are recommended to upgrade to version 2.4.59, which fixes this issue.
Acknowledgements:
- finder: Keran Mu, Tsinghua University and Zhongguancun Laboratory.
- finder: Jianjun Chen, Tsinghua University and Zhongguancun Laboratory.
Reported to security team 2023-09-06 Update 2.4.59 released 2024-04-04 Affects <=2.4.58 -
moderate: Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames ( CVE-2024-27316)
-
HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.
Acknowledgements: finder: Bartek Nowotarski (https://nowotarski.info/)
Reported to security team 2024-02-22 Update 2.4.59 released 2024-04-04 Affects <=2.4.58
Post subject: Apache httpd 2.4.59 GA Available
Apache httpd 2.4.59 is released as GA.
ASF and Apachelounge changes : https://www.apachelounge.com/Changelog-2.4.html
Important security vulnerabilities are fixed in 2.4.59, see https://httpd.apache.org/security/vulnerabilities_24.html .
VS17 Win32
The Win32 version is available again, see also discussion https://www.apachelounge.com/viewtopic.php?p=42099
Only build the with the standard Apache modules.
For non-standard modules (like mod_fcgid) use the VS16 Win32 ones at https://www.apachelounge.com/download/VS16/
Documentation: http://httpd.apache.org/docs/2.4/
Build with dependencies:
- openssl 3.1.5
- nghttp2 1.61.0
- jansson 2.14
- curl 8.7.1
- apr 1.7.3
- apr-util 1.6.3
- apr-iconv 1.2.2
- zlib 1.3.1
- brotli 1.1.0
- pcre2 10.43
- libxml2 2.12.6
- lua 5.4.6
- expat 2.5.0
Notes VS17 OpenSSL 3.x.x:
- Only PHP 8.2 and 8.1 (build with 3.x.x) is running as module.
Running with mod_fcgid no issues seen.
For running as module, See also the post from user Otomatic and notes at https://www.apachelounge.com/viewtopic.php?t=8969
and https://www.apachelounge.com/viewtopic.php?t=8938
- With too weak certificates/ciphers Apache does not start, see https://www.apachelounge.com/viewtopic.php?t=8819
Enjoy,
Steffen