Developers fix multitude of vulnerabilities in Apache HTTP Server
1–10 of 115 posts
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#2Full vulnerability list: https://httpd.apache.org/security/vulnerabilities_24.html
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#3On Debian 10, "apt update && apt upgrade" says all packages are up to date.
Did the fixes not land in Debian yet?
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#4Anybody still using Apache?
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#5Anybody still using Apache?
[deleted]
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#6On Debian 10, "apt update && apt upgrade" says all packages are up to date. Did the fixes not land in Debian yet?
>All five flaws are resolved with HTTP Server 2.4.49.
The WSL version of Ubuntu is reporting 2.4.41 for me still. I don't know about the real version.
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#7Anybody still using Apache?
Considering that it has a lot of features Nginx makes you pay for, yes
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#8This was an interesting security patch that marked the first time in my memory that updating Apache led to an immediate regression. A few hours after taking this upgrade many systems experienced such strange timeout errors. Connections were low and couldn't pinpoint the misleading behavior that looked like a slowloris attack, with no connections.
Half a day later with no resolution in research a new patch [1] was available and problem resolved.
[1] https://github.com/apache/httpd/commit/8720881b0634383145e87...
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#9Anybody still using Apache?
It appears so [1]. It's surprising how far behind most non-tech industries are when it comes to legacy software (not sure I'd call Apache "legacy", but still). I'd also be interested to see the stats for IT/developer positions in tech vs. non-tech fields. My intuition suggests that there are a lot more Apache sysadmins than you'd think.
Re: Developers fix multitude of vulnerabilities in Apache HTTP Server
#10Sometimes I think custom writing your own http server might not be a bad idea after all.
Lots of security holes in your custom write? Yes! But the hacker needs to be dedicated to exploiting your one server specifically to find it.
In exchange you are safe from of all those : vulnerabilities in the wild => script kiddies => mass exploitation => your are now hacked type of situations.