安全更新:mod_http3 v0.0.75 RPM 和 DEB 软件包已发布

mod_http3 v0.0.75 已新增到 CodeIT 仓库。这些软件包适用于 RHEL、CentOS、AlmaLinux、Rocky Linux 和 Oracle Linux 7、8、9 和 10,以及 Ubuntu 22.04 和 24.04。

本次更新修复了安全漏洞,建议尽快升级。

主要变更:

  • 在连接的整个生命周期内,客户端最多只能打开 H3MaxConcurrentStreams 个流:当客户端流关闭时,服务器从不归还流额度,因此在达到该数量的请求后客户端就会停住(默认 100 个)。从 v0.0.72 起就存在这个问题。

修复的漏洞:

  • SECURITY: HTTP/3 requests now run ap_check_request_header() and the post_read_request hooks, as HTTP/1.1 and HTTP/2 do. Before, server-level SetEnvIf and BrowserMatch, RemoteIPHeader, RequestHeader early and StrictHostCheck did not apply to HTTP/3, so a rule such as “Require not env bad_bot” could give 403 over HTTP/1.1 and 200 over HTTP/3. From apache/httpd PR #944.

Leave a Reply

Your email address will not be published. Required fields are marked *