Apache httpd 2.4.56-1 with brotli compression library from Google, TLS 1.3 Final (RFC 8446), http2 (HTTP/2) support for Red Hat Enterprise Linux and CentOS 7/8, Alma Linux 8, Rocky Linux 8 added to repository. mod_http2 2.0.13 is built dynamically against OpenSSL 1.1.1t.
- CVE-2023-27522: HTTP response smuggling bug
- CVE-2023-25690: HTTP request smuggling vulnerability
We build OpenSSL+QUIC 1.1.1 separately since v2.4.53-2, installing it separately to /lib64 with .so.81.1.1 suffix to ensure it won’t interfere with your system libraries. You can safely delete openssl111* packages.
On EL8 and EL9 please enable httpd module:
dnf module enable httpd:codeit