Security - Apache 2.4 RCEs

[richardtoohey2]

No natty name for the issue(s) so far.

Does not look like the updated version is in quarterly packages yet, but is in ports.

https://downloads.apache.org/httpd/CHANGES_2.4.71

If you have a server running Apache, you might want to patch when it is available.

 

[cracauer@]

I compiled apache24 from ports for this.

 

[richardtoohey2]

I think (but do not rely on me!) that the main issue occurs if you have mod_http2 enabled, which is not the default.

This will list all the modules you have built-in or loaded:

# httpd -t -D DUMP_MODULES

This line would be active in your httpd.conf (here it is commented out):

#LoadModule http2_module libexec/apache24/mod_http2.so

 

[SirDice]

I think (but do not rely on me!) that the main issue occurs if you have mod_http2 enabled

You are correct. Vulnerability exists in the http2_module only. So, if you don't need HTTP/2, don't load the module and you won't be vulnerable.

It is included with the standard apache24 port/package, but not enabled by default in httpd.conf.