39 ms·
Developers fix multitude of vulnerabilities in Apache HTTP Server
- edoceo 5y agoFull vulnerability list: https://httpd.apache.org/security/vulnerabilities_24.html https://httpd.apache.org/security/vulnerabilities_24.html
- deleted 5y ago[deleted]
- lucb1e 5y agoWhat I find interesting is that when browsing lists like these, more and more often I see names that are not from Europe or a rich English-speaking country. Nice to see previously-poorer countries getting online, the internet a bit more diverse, and the world a bit more connected. Though of course this is only empirical, perhaps it has always been this way and I just never noticed.
- hulitu 5y agoIt has always been this way. It's just that in the latest years the internet became more localized due to everyone wanting to take control of it. It is just sad.
- TekMol 5y agoOn Debian 10, "apt update && apt upgrade" says all packages are up to date. Did the fixes not land in Debian yet?
- forbiddenlake 5y agoYou can check the status of vulnerabilities like this with a quick Google of "Debian" plus the CVE. Example for this one is https://security-tracker.debian.org/tracker/CVE-2021-33193 https://security-tracker.debian.org/tracker/CVE-2021-33193 . When a patch is released, the package may not say 2.4.49, but that page will have the exact version number with the fix.
- TekMol 5y agoThis page confused me. It seems to have bugs for Android? Example: https://security-tracker.debian.org/tracker/CVE-2021-30521 https://security-tracker.debian.org/tracker/CVE-2021-30521 "Heap buffer overflow in Autofill in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page."
- meibo 5y agoWhile bugs like that aren't "confirmed" to affect desktop versions of software, the underlying bug is still in the Desktop codebase and needs to be treated as a security issue.
- wccrawford 5y ago>All five flaws are resolved with HTTP Server 2.4.49. The WSL version of Ubuntu is reporting 2.4.41 for me still. I don't know about the real version.
- xxpor 5y agoWSL ubuntu uses the same repos as regular ubuntu so they should be in sync
- dtech 5y agoDebian back-ports patches. I guess they'll need some time although they are usually informed in advance
- beermonster 5y agoQuite often there are many vulnerabilities with no ‘fixed-in’ version (as it’s not yet fixed) and this can be for some time. https://security-tracker.debian.org/tracker/status/release/stable https://security-tracker.debian.org/tracker/status/release/s... is one place to look through in the past I think there was a better link I used to use to find all vulnerable packages which were awaiting a fix - but I can’t seem to find it now.
- dspillett 5y agoCould be the case. Could also be that the bugs were never in Debian if they were introduced recently as Debian stable is relatively conservative about package updates other than for security purposes.
- atatatat 5y agoThe long(er) patch cycle is why I switched away from Debian. Decent privacy, questionable security vs stability if you're serious about it.
- kimi 5y agoAnybody still using Apache?
- jmnicolas 5y agoWhat's wrong with Apache? (honest question)
- LinuxBender 5y agoNothing really. Historically Apache HTTPD was slower than the newer web servers like NGinx when Apache HTTPD 2.2 was the mainline version. This is no longer the case with Apache 2.4 using the latest APR libraries. 2.4 has been out for a very long time, but some Linux distros were slow to uptake it.
- da_chicken 5y agoJust like some of them were slow to take on 2.2 over 2.0, and 2.0 over 1.2. Web servers have historically been pretty conservative as far as software goes.
- trey-jones 5y agoAbout a decade ago nginx stormed onto the scene with event based multi-processing, and even though mpm-event became a thing not too long after that, Apache retained mpm-prefork and then mpm-worker as defaults for a very long time, and lost a lot of market share. A lot of people still retain the notion that nginx is "just faster" or "just better" which is not necessarily the case. Apache with mpm-event is just fine for most applications. There are other reasons to use nginx, and there are other reasons to use Apache. Both are fine, and I hear https://caddyserver.com/ https://caddyserver.com/ is coming in hot!
- mholt 5y agoYeah; and unlike nginx and Apache, Caddy has a higher degree of memory safety, so it's impervious to a whole class of vulnerabilities.
- iBotPeaches 5y agoThis was an interesting security patch that marked the first time in my memory that updating Apache led to an immediate regression. A few hours after taking this upgrade many systems experienced such strange timeout errors. Connections were low and couldn't pinpoint the misleading behavior that looked like a slowloris attack, with no connections. Half a day later with no resolution in research a new patch [1] was available and problem resolved. [1] https://github.com/apache/httpd/commit/8720881b0634383145e87334f1456cbcab4cb6cc https://github.com/apache/httpd/commit/8720881b0634383145e87...
- sam_lowry_ 5y agoThose who can't program, go to security research.
- junon 5y agoDo you know what security research entails?
- benreesman 5y agoI’m replying to you because the parent is flagged. I’m not a security guy, but I am a serious generalist and I’ll try my hand at anything. Except security. As finely as I try to hone my craft, as much discipline as I bring to it, and as many great results as I’ve produced: computer security is a completely different ballgame. The guys and gals who are as sophisticated, and diligent, and dedicated, and ultimately humble enough to be serious security pros are a breed apart, and my hat is off to them.
- nocsi 5y agoIt might be because they had patch cycle commitments. Ideally you want this stuff to be tucked into the regular release cycle. It costs companies a shit load of money to release and out of band update, esp when security related
- habibur 5y agoSometimes I think custom writing your own http server might not be a bad idea after all. Lots of security holes in your custom write? Yes! But the hacker needs to be dedicated to exploiting your one server specifically to find it. In exchange you are safe from of all those : vulnerabilities in the wild => script kiddies => mass exploitation => your are now hacked type of situations.
- rastafang 5y ago> In exchange you are safe from of all those : vulnerabilities in the wild => script kiddies => mass exploitation => your are hacked type of situations. Not sure about that... You might commit some of the same mistakes that they did
- indigodaddy 5y agoExactly what I was thinking. You’re more likely just to have a wide open and highly/easily penetrable/vulnerable server up for grabs at that point.
- lanstin 5y agoPresumably you'll have less features. I wrote a web server (in the 90s, so forgivable?), and I only implemented GET and query string for the API data, and nothing fancy, no cache headers, no redirects, no multipart, no gzip, no content-encoding negotiation, etc. Some of the APIs it hosted were ultimately hacked (thru encryption of the encrypted query string via plain DES, and the key was determined), but, so far as I know, it was not itself ever compromised.
- indigodaddy 5y agoAh yes, that would make sense.
- rastafang 5y agoNot impossible that your web server was 100% secure, but I doubt it because I think that I have never seen a server that didn't eventually need security patches.
- DonHopkins 5y agoIt's called Apache HTTP server because it's A Patchy HTTP Server. https://www.mail-archive.com/fedora-list@redhat.com/msg06924.html https://www.mail-archive.com/fedora-list@redhat.com/msg06924... >On Jul 16, 2008, Les Mikesell wrote: >> Alexandre Oliva wrote: >> Apache wasn't the original name. >It was and it wasn't. It was indeed a bunch of patches on top of the (also younger) NCSA http server. That's where "a patchy http server" came from. But that was '90s already, some ten years after GNU started.
- FreezingKeeper 5y agoEvery day someone is born who has never seen The Flintstones
- RobotCaleb 5y agoEveryday someone is born who hasn't seen everything, or anything.
- aargh_aargh 5y agohttps://xkcd.com/1053/ https://xkcd.com/1053/
- Thorrez 5y agoIs this a reference to something I'm not understanding? I don't know how the Flintstones are related to Apache.
- deleted 5y ago[deleted]
- ezekiel68 5y agoIt turns out that "multitude", in this case, is 5. (Still glad they got patched, of course)
- JulianMorrison 5y agoHrair
- hinkley 5y agoMultitude: a very great number 5 is a very good number but I don’t know if I’d go so far as to call it “great”.
- junon 5y ago5 vulnerabilities at once is a lot.
- torstenvl 5y agoA very good number, some people say great, I don't know, maybe even one of the very best! That's what people are saying.
- nobody9999 5y agoDonny, is that you?
- 5y ago
- egberts1 5y agoOh boy, once Apache goofed with incomplete error reporting on simply why .htaccess failed, most of who i know has moved on to other kinds of HTTP servers.