Opened 2 years ago

Closed 2 years ago

Last modified 2 years ago

#20103 closed enhancement (fixed)

httpd-2.4.62

Reported by: Bruce Dubbs Owned by: Bruce Dubbs
Priority: elevated Milestone: 12.2
Component: BOOK Version: git
Severity: medium Keywords:
Cc:

Description

New point version.

Change History (6)

comment:1 by Bruce Dubbs, 2 years ago

Owner: changed from blfs-book to Bruce Dubbs
Status: new → assigned

comment:2 by Douglas R. Reno, 2 years ago

Priority: normal → elevated

comment:3 by Bruce Dubbs, 2 years ago

Changes with Apache 2.4.62

  • mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for "balancer:" URLs set via SetHandler, also allowing for "unix:" sockets with BalancerMember(s).
  • mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs.
  • mod_ssl: Fix crashes in PKCS#11 ENGINE support with OpenSSL 3.2.
  • mod_ssl: Add support for loading certs/keys from pkcs11: URIs via OpenSSL 3.x providers.
  • mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL >= 3.0.
  • mpm_worker: Fix possible warning (AH00045) about children processes not terminating timely.

comment:4 by Bruce Dubbs, 2 years ago

Resolution: → fixed
Status: assigned → closed

Fixed at commits 

df2c1af144 Update to cmake-3.30.1.
2ec10c47f4 Update to httpd-2.4.62.

comment:5 by Douglas R. Reno, 2 years ago

CVE-2024-40725 

Severity: important

Affected versions:

- Apache HTTP Server 2.4.60 through 2.4.61

Description:

A partial fix for  CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some 
use of the legacy content-type based configuration of handlers. "AddType" and similar 
configuration, under some circumstances where files are requested indirectly, result in 
source code disclosure of local content. For example, PHP scripts may be served instead 
of interpreted.

Users are recommended to upgrade to version 2.4.62, which fixes this issue.

References:

https://httpd.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-40725

Timeline:

2024-07-09: reported

comment:6 by Douglas R. Reno, 2 years ago

SA-12.1-067 updated to point users towards this version of httpd

Note: See TracTickets for help on using tickets.