possible vuln to patch in Apache HTTP Server? (version 2.4.51 and earlier)

[mmerlin]

Hi, are these two new vulnerabilities of any concern for plain vanilla installs of standard DA? (Apache+NGINX for httpd)

Critical Apache HTTPD Server Bugs Could Lead to RCE, DoS

Don't freak: It's got nothing to do with Log4Shell, except it may be just as far-reaching as Log4j, given HTTPD's tendency to tiptoe into software projects.

threatpost.com

CVE-2021-44790: Possible buffer overflow when parsing a carefully crafted request in the mod_lua multipart parser of Apache HTTP Server 2.4.51 and earlier.

CVE-2021-44224: Possible NULL dereference or Server Side Request Forgery (SSRF) in forward proxy configurations

 

[ikkeben]

Hi, are these two new vulnerabilities of any concern for plain vanilla installs of standard DA? (Apache+NGINX for httpd)

Apache 2.4.52

2 CVE's updates this version *) SECURITY: CVE-2021-44790: Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier (cve.mitre.org) A carefully crafted request body can cause a buffer overflow in the mod_lua multipart...

forum.directadmin.com

Please be careful with updates while to many problems ....?


No answer but @DirectAdmin Support take care of the "many" httpd problems please?

apache 2.4.49,2.4.52 strange unreachable after pass few hours

Do you have CSF firewall running on your server? All our servers are installed with CSF by default, so yes

forum.directadmin.com

 

[k1l0b1t]

I have no issues with 2.4.52, just apache, php fpm and deb11

 

[Richard G]

Please be careful with updates while to many problems ....?

Some do have issues, some don't. I also don't have issues. People with issues can easily revert. And at this moment people need to use the custom setting to upgrade to 2.4.52.

You can read in the other thread that DA does not use mod_lua by default.

 

[mmerlin]

You can read in the other thread that DA does not use mod_lua by default.

Ah ha thanks!

Good to know we are not vuln by default

Apache 2.4.52

2 CVE's updates this version *) SECURITY: CVE-2021-44790: Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier (cve.mitre.org) A carefully crafted request body can cause a buffer overflow in the mod_lua multipart...

forum.directadmin.com