5 ms·
For something this severe, there doesn’t appear to have been coordination with large shared hosting providers to ensure the patch was applied before public disc
by btown 8y ago
For something this severe, there doesn’t appear to have been coordination with large shared hosting providers to ensure the patch was applied before public disclosure of a PoC. Is there a system in place for this?
- foobarbazetc 8y agoIt doesn’t effect CentOS 7, which is what most hosting providers run on.
- equalunique 8y agoHow do you know it doesn't affect CentOS 7? Please provide a citation for your claim. :)
- ihattendorf 8y agoI'm not the person you're replying to, but: https://access.redhat.com/security/cve/cve-2019-0211 https://access.redhat.com/security/cve/cve-2019-0211 My guess is because they're on an older version (2.4.6) that isn't affected. But that all depends on what patches have been applied to the RHEL/CentOS version.
- tannhaeuser 8y agoYou're sure? From what I've experienced, shared hosting is owned by Debian/Devuan and Ubuntu, typically on a Debian-style Apache installation with modular config file directories and enmod/ensite utilties for management.
- regecks 8y agoWell, most shared hosting providers are also running cPanel on CentOS 7 and are getting their httpd packages from EasyApache 3/4, not from the CentOS base repo. cPanel definitely responded to this CVE: https://github.com/CpanelInc/ea-apache2/blob/386800043a02e88a490596f11373a5fc0e66a8fd/SPECS/ea-apache24.spec#L1959 https://github.com/CpanelInc/ea-apache2/blob/386800043a02e88...