Веб-серверы: уязвимости стека · Страница 9

NGINX MP4 module vulnerability

NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with the ngx_http_mp4_module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted mp4 file with the ngx_http_mp4_module.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

• Обновитесь до 1.10.3-0ubuntu0.16.04.5+esm6
• Обновитесь до 1.14.0-0ubuntu1.11+esm1
• Обновитесь до 1.18.0-0ubuntu1.6
• Обновитесь до 1.18.0-6ubuntu14.5
• Обновитесь до 1.22.1-9+deb12u2
• Обновитесь до 1.24.0-2ubuntu7.1
• Обновитесь до 1.26.0-2
• Обновитесь до 1.26.2
• Обновитесь до 1.4.6-1ubuntu3.9+esm5

Apache HTTP Server: source code disclosure with handlers configured via AddType

A partial fix for  CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted. Users are recommended to upgrade to version 2.4.62, which fixes this issue.

• Обновитесь до 2.4.41-4ubuntu3.21
• Обновитесь до 2.4.52-1ubuntu4.12
• Обновитесь до 2.4.58-1ubuntu8.4
• Обновитесь до 2.4.62-1
• Обновитесь до 2.4.62-1~deb12u1

Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows

SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests. Users are recommended to upgrade to version 2.4.62 which fixes this issue. 

Traefik vulnerable to bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakes

Traefik is an HTTP reverse proxy and load balancer. Versions prior to 2.11.6, 3.0.4, and 3.1.0-rc3 have a vulnerability that allows bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakes sent with spoofed IP addresses. Versions 2.11.6, 3.0.4, and 3.1.0-rc3 contain a patch for this issue. No known workarounds are available.

Apache HTTP Server: source code disclosure with handlers configured via AddType

A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers.   "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted. Users are recommended to upgrade to version 2.4.61, which fixes this issue.

• Обновитесь до 2.4.41-4ubuntu3.19
• Обновитесь до 2.4.52-1ubuntu4.10
• Обновитесь до 2.4.58-1ubuntu8.2
• Обновитесь до 2.4.61-1

Apache HTTP Server: mod_rewrite proxy handler substitution

Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URL's to be handled by mod_proxy. Users are recommended to upgrade to version 2.4.60, which fixes this issue.

• Обновитесь до 2.4.18-2ubuntu3.17+esm17
• Обновитесь до 2.4.29-1ubuntu4.27+esm7
• Обновитесь до 2.4.41-4ubuntu3.19
• Обновитесь до 2.4.52-1ubuntu4.10
• Обновитесь до 2.4.58-1ubuntu8.2
• Обновитесь до 2.4.60-1
• Обновитесь до 2.4.61-1~deb12u1
• Обновитесь до 2.4.7-1ubuntu4.22+esm12

Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request

null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request. Users are recommended to upgrade to version 2.4.60, which fixes this issue.

• Обновитесь до 2.4.18-2ubuntu3.17+esm13
• Обновитесь до 2.4.29-1ubuntu4.27+esm3
• Обновитесь до 2.4.41-4ubuntu3.19
• Обновитесь до 2.4.52-1ubuntu4.10
• Обновитесь до 2.4.58-1ubuntu8.2
• Обновитесь до 2.4.60-1
• Обновитесь до 2.4.61-1~deb12u1
• Обновитесь до 2.4.7-1ubuntu4.22+esm12

Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect

Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable. Users are recommended to upgrade to version 2.4.60, which fixes this issue.

• Обновитесь до 2.4.18-2ubuntu3.17+esm13
• Обновитесь до 2.4.29-1ubuntu4.27+esm3
• Обновитесь до 2.4.41-4ubuntu3.19
• Обновитесь до 2.4.52-1ubuntu4.10
• Обновитесь до 2.4.58-1ubuntu8.2
• Обновитесь до 2.4.60-1
• Обновитесь до 2.4.61-1~deb12u1
• Обновитесь до 2.4.7-1ubuntu4.22+esm12

Apache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.

Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure. Substitutions in server context that use a backreferences or variables as the first segment of the substitution are affected.  Some unsafe RewiteRules will be broken by this change and the rewrite flag "UnsafePrefixStat" can be used to opt back in once ensuring the substitution is appropriately constrained.

• Обновитесь до 2.4.18-2ubuntu3.17+esm13
• Обновитесь до 2.4.29-1ubuntu4.27+esm3
• Обновитесь до 2.4.41-4ubuntu3.19
• Обновитесь до 2.4.52-1ubuntu4.10
• Обновитесь до 2.4.58-1ubuntu8.2
• Обновитесь до 2.4.60-1
• Обновитесь до 2.4.61-1~deb12u1
• Обновитесь до 2.4.7-1ubuntu4.22+esm10

Apache HTTP Server weakness with encoded question marks in backreferences

Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or source disclosure of scripts meant to only to be executed as CGI. Users are recommended to upgrade to version 2.4.60, which fixes this issue. Some RewriteRules that capture and substitute unsafely will now fail unless rewrite flag "UnsafeAllow3F" is specified.

• Обновитесь до 2.4.18-2ubuntu3.17+esm14
• Обновитесь до 2.4.29-1ubuntu4.27+esm4
• Обновитесь до 2.4.41-4ubuntu3.23
• Обновитесь до 2.4.52-1ubuntu4.16
• Обновитесь до 2.4.58-1ubuntu8.8
• Обновитесь до 2.4.60-1
• Обновитесь до 2.4.61-1~deb12u1
• Обновитесь до 2.4.7-1ubuntu4.22+esm10

Apache HTTP Server proxy encoding problem

Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. Users are recommended to upgrade to version 2.4.60, which fixes this issue.

• Обновитесь до 2.4.18-2ubuntu3.17+esm17
• Обновитесь до 2.4.29-1ubuntu4.27+esm7
• Обновитесь до 2.4.41-4ubuntu3.19
• Обновитесь до 2.4.52-1ubuntu4.10
• Обновитесь до 2.4.58-1ubuntu8.2
• Обновитесь до 2.4.60-1
• Обновитесь до 2.4.61-1~deb12u1

Apache HTTP Server on WIndows UNC SSRF

SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue.  Note: Existing configurations that access UNC paths will have to configure new directive "UNCList" to allow access during request processing.

Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2

Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance.

• Обновитесь до 2.4.41-4ubuntu3.19
• Обновитесь до 2.4.52-1ubuntu4.10
• Обновитесь до 2.4.58-1ubuntu8.2
• Обновитесь до 2.4.60-1
• Обновитесь до 2.4.61-1~deb12u1

NGINX HTTP/3 QUIC vulnerability

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module and the network infrastructure supports a Maximum Transmission Unit (MTU) of 4096 or greater without fragmentation, undisclosed QUIC packets can cause NGINX worker processes to leak previously freed memory.

• Обновитесь до 1.26.0-2
• Обновитесь до 1.26.1

NGINX HTTP/3 QUIC vulnerability

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate.

• Обновитесь до 1.26.0-2
• Обновитесь до 1.26.1

NGINX HTTP/3 QUIC vulnerability

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 encoder instructions can cause NGINX worker processes to terminate or cause or other potential impact.

• Обновитесь до 1.26.0-2
• Обновитесь до 1.26.1

NGINX HTTP/3 QUIC vulnerability

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed HTTP/3 requests can cause NGINX worker processes to terminate or cause other potential impact. This attack requires that a request be specifically timed during the connection draining process, which the attacker has no visibility and limited influence over.

• Обновитесь до 1.26.0-2
• Обновитесь до 1.26.1

Possible denial of service vulnerability with Content-length header in Traefik

Traefik is an HTTP reverse proxy and load balancer. In affected versions sending a GET request to any Traefik endpoint with the "Content-length" request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to induce a denial of service. This vulnerability has been addressed in version 2.11.2 and 3.0.0-rc5. Users are advised to upgrade. For affected versions, this vulnerability can be mitigated by configuring the readTimeout option.

Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames

HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.

• Обновитесь до 2.4.18-2ubuntu3.17+esm12
• Обновитесь до 2.4.29-1ubuntu4.27+esm2
• Обновитесь до 2.4.41-4ubuntu3.17
• Обновитесь до 2.4.52-1ubuntu4.9
• Обновитесь до 2.4.58-1ubuntu8.1
• Обновитесь до 2.4.59-1
• Обновитесь до 2.4.59-1~deb12u1

Apache HTTP Server: HTTP Response Splitting in multiple modules

HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack. Users are recommended to upgrade to version 2.4.59, which fixes this issue.

• Обновитесь до 2.4.18-2ubuntu3.17+esm12
• Обновитесь до 2.4.29-1ubuntu4.27+esm2
• Обновитесь до 2.4.41-4ubuntu3.17
• Обновитесь до 2.4.52-1ubuntu4.9
• Обновитесь до 2.4.58-1ubuntu8.1
• Обновитесь до 2.4.59-1
• Обновитесь до 2.4.59-1~deb12u1
• Обновитесь до 2.4.7-1ubuntu4.22+esm12