What versions of Apache are vulnerable?
One of these vulnerabilities was exploited in the wild. The Apache HTTP Server 2.4. 49 is vulnerable to a flaw that allows attackers to use a path traversal attack to map URLs to files outside the expected document root.
What vulnerability is unique to Apache Web server?
low: mod_proxy_http NULL pointer dereference (CVE-2020-13950)
| Reported to security team | 2020-09-11 |
|---|---|
| Issue public | 2021-06-01 |
| Update 2.4.48 released | 2021-06-01 |
| Affects | 2.4.46, 2.4.43, 2.4.41 |
What is the latest version of Apache?
The current latest release for Apache httpd is version 2.4. 46. However, this is more of a minor update with a small handful of security updates addressing CVE-2020-11984, CVE-2020-11993, and slight modifications to mod_http2. The last major release of Apache server was 2.4 and that was close to a decade ago.
When was Apache 2.2 last release?
Development
| Version | Initial release | Latest release |
|---|---|---|
| 2.0 | 2002-04-06 | 2013-07-10 (2.0.65) |
| 2.2 | 2005-12-01 | 2017-07-11 (2.2.34) |
| 2.4 | 2012-02-21 | 2021-10-07 (2.4.51) |
| Old version Latest version |
Does Tomcat use Apache HTTP server?
Tomcat is primarily an application server, which serves requests to custom-built Java servlets or JSP files on your server. It is usually used in conjunction with the Apache HTTP server (at least in my experience). Use it to manually process incoming requests.
Is Apache Web server secure?
The Apache web server is one of the most popular web servers available for both Windows and Linux/UNIX. At the moment, it is used to host approximately 40% of websites. It is also often described as one of the most secure web servers.
What exactly is Apache?
Apache is the most widely used web server software. Developed and maintained by Apache Software Foundation, Apache is an open source software available for free. It runs on 67% of all webservers in the world. It is fast, reliable, and secure. Most WordPress hosting providers use Apache as their web server software.
Does nginx replace Apache?
At first, people mostly used Nginx as an Apache supplement. It was used mostly for serving static files, but today, it has evolved as a complete web server that deals with the full spectrum of server tasks. Today, Nginx is often used as a reverse proxy, load balancer, mail proxy and for HTTP caching.
Are there any vulnerabilities in Apache HTTP Server?
A flaw was found in the way the Apache HTTP Server handled Range HTTP headers. A remote attacker could use this flaw to cause httpd to use an excessive amount of memory and CPU time via HTTP requests with a specially-crafted Range header. This could be used in a denial of service attack.
What are the flaws in the Apache server?
A flaw was found in the Apache HTTP Server mod_proxy module. On sites where a reverse proxy is configured, a remote attacker could send a carefully crafted request that would cause the Apache child process handling that request to crash.
Is there a cve-2019-0217 in Apache HTTP Server?
important: mod_auth_digest access control bypass (CVE-2019-0217) In Apache HTTP Server 2.4 release 2.4.38 and prior, a race condition in mod_auth_digest when running in a threaded server could allow a user with valid credentials to authenticate using another username, bypassing configured access control restrictions.
Is it safe to use Apache httpd 2.2?
Apache httpd 2.2 is End-of-Life since December 2017 and should not be used. This page only lists security issues that occurred before the End-of-Life. Subsequent issues may have affected 2.2 but will not be investigated or listed here. Users are advised to upgrade to the currently supported released version to address known issues.