Security - Apache 2.4 RCEs

[richardtoohey2]

No natty name for the issue(s) so far.

Does not look like the updated version is in quarterly packages yet, but is in ports.

https://downloads.apache.org/httpd/CHANGES_2.4.71

If you have a server running Apache, you might want to patch when it is available.

 

[cracauer@]

I compiled apache24 from ports for this.

 

[richardtoohey2]

I think (but do not rely on me!) that the main issue occurs if you have mod_http2 enabled, which is not the default.

This will list all the modules you have built-in or loaded:

# httpd -t -D DUMP_MODULES

This line would be active in your httpd.conf (here it is commented out):

#LoadModule http2_module libexec/apache24/mod_http2.so