forked from pool/apache2
9ac936a203
*) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with
mod_rewrite in server/vhost context on Windows (cve.mitre.org)
[boo#1228098]
SSRF in Apache HTTP Server on Windows with mod_rewrite in
server/vhost context, allows to potentially leak NTML hashes to
a malicious server via SSRF and malicious requests.
Users are recommended to upgrade to version 2.4.62 which fixes
this issue.
Credits: Smi1e (DBAPPSecurity Ltd.)
*) SECURITY: CVE-2024-40725: Apache HTTP Server: source code
disclosure with handlers configured via AddType (cve.mitre.org)
[boo#1228097]
A partial fix for CVE-2024-39884 in the core of Apache HTTP
Server 2.4.61 ignores some use of the legacy content-type based
configuration of handlers. "AddType" and similar configuration,
under some circumstances where files are requested indirectly,
result in source code disclosure of local content. For example,
PHP scripts may be served instead of interpreted.
Users are recommended to upgrade to version 2.4.62, which fixes
this issue.
*) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for
"balancer:" URLs set via SetHandler, also allowing for "unix:" sockets
with BalancerMember(s). PR 69168. [Yann Ylavic]
*) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs.
PR 69160 [Yann Ylavic]
*) mod_ssl: Fix crashes in PKCS#11 ENGINE support with OpenSSL 3.2.
[Joe Orton]
*) mod_ssl: Add support for loading certs/keys from pkcs11: URIs
via OpenSSL 3.x providers. [Ingo Franzki <ifranzki linux.ibm.com>]
*) mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL >= 3.0.
[Ruediger Pluem, Yann Ylavic]
*) mpm_worker: Fix possible warning (AH00045) about children processes not
terminating timely. [Yann Ylavic]
OBS-URL: https://build.opensuse.org/package/show/Apache/apache2?expand=0&rev=706
74 lines
2.9 KiB
Plaintext
74 lines
2.9 KiB
Plaintext
|
|
#
|
|
# Customizable error responses come in three flavors:
|
|
# 1) plain text 2) local redirects 3) external redirects
|
|
#
|
|
# Some examples:
|
|
#ErrorDocument 500 "The server made a boo boo."
|
|
#ErrorDocument 404 /missing.html
|
|
#ErrorDocument 404 "/cgi-bin/missing_handler.pl"
|
|
#ErrorDocument 402 http://www.example.com/subscription_info.html
|
|
#
|
|
|
|
#
|
|
# Putting this all together, we can internationalize error responses.
|
|
#
|
|
# We use Alias to redirect any /error/HTTP_<error>.html.var response to
|
|
# our collection of by-error message multi-language collections. We use
|
|
# includes to substitute the appropriate text.
|
|
#
|
|
# You can modify the messages' appearance without changing any of the
|
|
# default HTTP_<error>.html.var files by adding the line:
|
|
#
|
|
# Alias /error/include/ "/your/include/path/"
|
|
#
|
|
# which allows you to create your own set of files by starting with the
|
|
# /usr/share/apache2/error/include/ files and copying them to /your/include/path/,
|
|
# even on a per-VirtualHost basis. The default include files will display
|
|
# your Apache version number and your ServerAdmin email address regardless
|
|
# of the setting of ServerSignature.
|
|
#
|
|
# The internationalized error documents require mod_alias, mod_include
|
|
# and mod_negotiation. To activate them, uncomment the following 30 lines.
|
|
|
|
Alias /error/ "/usr/share/apache2/error/"
|
|
|
|
<IfModule mod_negotiation.c>
|
|
<IfModule mod_include.c>
|
|
<Directory "/usr/share/apache2/error">
|
|
AllowOverride None
|
|
Options IncludesNoExec
|
|
AddOutputFilter Includes html
|
|
AddHandler type-map var
|
|
<IfModule !mod_access_compat.c>
|
|
Require all granted
|
|
</IfModule>
|
|
<IfModule mod_access_compat.c>
|
|
Order allow,deny
|
|
Allow from all
|
|
</IfModule>
|
|
LanguagePriority en cs de es fr it ja ko nl pl pt-br ro sv tr
|
|
ForceLanguagePriority Prefer Fallback
|
|
</Directory>
|
|
|
|
ErrorDocument 400 /error/HTTP_BAD_REQUEST.html.var
|
|
ErrorDocument 401 /error/HTTP_UNAUTHORIZED.html.var
|
|
ErrorDocument 403 /error/HTTP_FORBIDDEN.html.var
|
|
ErrorDocument 404 /error/HTTP_NOT_FOUND.html.var
|
|
ErrorDocument 405 /error/HTTP_METHOD_NOT_ALLOWED.html.var
|
|
ErrorDocument 408 /error/HTTP_REQUEST_TIME_OUT.html.var
|
|
ErrorDocument 410 /error/HTTP_GONE.html.var
|
|
ErrorDocument 411 /error/HTTP_LENGTH_REQUIRED.html.var
|
|
ErrorDocument 412 /error/HTTP_PRECONDITION_FAILED.html.var
|
|
ErrorDocument 413 /error/HTTP_REQUEST_ENTITY_TOO_LARGE.html.var
|
|
ErrorDocument 414 /error/HTTP_REQUEST_URI_TOO_LARGE.html.var
|
|
ErrorDocument 415 /error/HTTP_UNSUPPORTED_MEDIA_TYPE.html.var
|
|
ErrorDocument 500 /error/HTTP_INTERNAL_SERVER_ERROR.html.var
|
|
ErrorDocument 501 /error/HTTP_NOT_IMPLEMENTED.html.var
|
|
ErrorDocument 502 /error/HTTP_BAD_GATEWAY.html.var
|
|
ErrorDocument 503 /error/HTTP_SERVICE_UNAVAILABLE.html.var
|
|
ErrorDocument 506 /error/HTTP_VARIANT_ALSO_VARIES.html.var
|
|
</IfModule>
|
|
</IfModule>
|
|
|