forked from pool/apache2
*) SECURITY: CVE-2024-40898: Apache HTTP Server: SSRF with mod_rewrite in server/vhost context on Windows (cve.mitre.org) [boo#1228098] SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests. Users are recommended to upgrade to version 2.4.62 which fixes this issue. Credits: Smi1e (DBAPPSecurity Ltd.) *) SECURITY: CVE-2024-40725: Apache HTTP Server: source code disclosure with handlers configured via AddType (cve.mitre.org) [boo#1228097] A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted. Users are recommended to upgrade to version 2.4.62, which fixes this issue. *) mod_proxy: Fix canonicalisation and FCGI env (PATH_INFO, SCRIPT_NAME) for "balancer:" URLs set via SetHandler, also allowing for "unix:" sockets with BalancerMember(s). PR 69168. [Yann Ylavic] *) mod_proxy: Avoid AH01059 parsing error for SetHandler "unix:" URLs. PR 69160 [Yann Ylavic] *) mod_ssl: Fix crashes in PKCS#11 ENGINE support with OpenSSL 3.2. [Joe Orton] *) mod_ssl: Add support for loading certs/keys from pkcs11: URIs via OpenSSL 3.x providers. [Ingo Franzki <ifranzki linux.ibm.com>] *) mod_ssl: Restore SSL dumping on trace7 loglevel with OpenSSL >= 3.0. [Ruediger Pluem, Yann Ylavic] *) mpm_worker: Fix possible warning (AH00045) about children processes not terminating timely. [Yann Ylavic] OBS-URL: https://build.opensuse.org/package/show/Apache/apache2?expand=0&rev=706
134 lines
4.7 KiB
Plaintext
134 lines
4.7 KiB
Plaintext
#
|
|
# VirtualHost template
|
|
# Note: to use the template, rename it to /etc/apache2/vhost.d/yourvhost.conf.
|
|
# Files must have the .conf suffix to be loaded.
|
|
#
|
|
# See https://en.opensuse.org/SDB:Apache_installation for further hints
|
|
# about virtual hosts.
|
|
#
|
|
# Almost any Apache directive may go into a VirtualHost container.
|
|
# The first VirtualHost section is used for requests without a known
|
|
# server name.
|
|
#
|
|
<VirtualHost *:80>
|
|
ServerAdmin webmaster@dummy-host.example.com
|
|
ServerName dummy-host.example.com
|
|
|
|
# DocumentRoot: The directory out of which you will serve your
|
|
# documents. By default, all requests are taken from this directory, but
|
|
# symbolic links and aliases may be used to point to other locations.
|
|
DocumentRoot /srv/www/vhosts/dummy-host.example.com
|
|
|
|
# if not specified, the global error log is used
|
|
ErrorLog /var/log/apache2/dummy-host.example.com-error_log
|
|
CustomLog /var/log/apache2/dummy-host.example.com-access_log combined
|
|
|
|
# don't loose time with IP address lookups
|
|
HostnameLookups Off
|
|
|
|
# needed for named virtual hosts
|
|
UseCanonicalName Off
|
|
|
|
# configures the footer on server-generated documents
|
|
ServerSignature On
|
|
|
|
|
|
# Optionally, include *.conf files from /etc/apache2/conf.d/
|
|
#
|
|
# For example, to allow execution of PHP scripts:
|
|
#
|
|
# Include /etc/apache2/conf.d/php5.conf
|
|
#
|
|
# or, to include all configuration snippets added by packages:
|
|
# Include /etc/apache2/conf.d/*.conf
|
|
|
|
|
|
# ScriptAlias: This controls which directories contain server scripts.
|
|
# ScriptAliases are essentially the same as Aliases, except that
|
|
# documents in the realname directory are treated as applications and
|
|
# run by the server when requested rather than as documents sent to the client.
|
|
# The same rules about trailing "/" apply to ScriptAlias directives as to
|
|
# Alias.
|
|
#
|
|
ScriptAlias /cgi-bin/ "/srv/www/vhosts/dummy-host.example.com/cgi-bin/"
|
|
|
|
# "/srv/www/cgi-bin" should be changed to whatever your ScriptAliased
|
|
# CGI directory exists, if you have one, and where ScriptAlias points to.
|
|
#
|
|
<Directory "/srv/www/vhosts/dummy-host.example.com/cgi-bin">
|
|
AllowOverride None
|
|
Options +ExecCGI -Includes
|
|
<IfModule !mod_access_compat.c>
|
|
Require all granted
|
|
</IfModule>
|
|
<IfModule mod_access_compat.c>
|
|
Order allow,deny
|
|
Allow from all
|
|
</IfModule>
|
|
</Directory>
|
|
|
|
|
|
# UserDir: The name of the directory that is appended onto a user's home
|
|
# directory if a ~user request is received.
|
|
#
|
|
# To disable it, simply remove userdir from the list of modules in APACHE_MODULES
|
|
# in /etc/sysconfig/apache2.
|
|
#
|
|
<IfModule mod_userdir.c>
|
|
# Note that the name of the user directory ("public_html") cannot simply be
|
|
# changed here, since it is a compile time setting. The apache package
|
|
# would have to be rebuilt. You could work around by deleting
|
|
# /usr/sbin/suexec, but then all scripts from the directories would be
|
|
# executed with the UID of the webserver.
|
|
UserDir public_html
|
|
# The actual configuration of the directory is in
|
|
# /etc/apache2/mod_userdir.conf.
|
|
Include /etc/apache2/mod_userdir.conf
|
|
# You can, however, change the ~ if you find it awkward, by mapping e.g.
|
|
# http://www.example.com/users/karl-heinz/ --> /home/karl-heinz/public_html/
|
|
#AliasMatch ^/users/([a-zA-Z0-9-_.]*)/?(.*) /home/$1/public_html/$2
|
|
</IfModule>
|
|
|
|
|
|
#
|
|
# This should be changed to whatever you set DocumentRoot to.
|
|
#
|
|
<Directory "/srv/www/vhosts/dummy-host.example.com">
|
|
|
|
#
|
|
# Possible values for the Options directive are "None", "All",
|
|
# or any combination of:
|
|
# Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
|
|
#
|
|
# Note that "MultiViews" must be named *explicitly* --- "Options All"
|
|
# doesn't give it to you.
|
|
#
|
|
# The Options directive is both complicated and important. Please see
|
|
# http://httpd.apache.org/docs/2.4/mod/core.html#options
|
|
# for more information.
|
|
#
|
|
Options Indexes FollowSymLinks
|
|
|
|
#
|
|
# AllowOverride controls what directives may be placed in .htaccess files.
|
|
# It can be "All", "None", or any combination of the keywords:
|
|
# Options FileInfo AuthConfig Limit
|
|
#
|
|
AllowOverride None
|
|
|
|
#
|
|
# Controls who can get stuff from this server.
|
|
#
|
|
<IfModule !mod_access_compat.c>
|
|
Require all granted
|
|
</IfModule>
|
|
<IfModule mod_access_compat.c>
|
|
Order allow,deny
|
|
Allow from all
|
|
</IfModule>
|
|
|
|
</Directory>
|
|
|
|
</VirtualHost>
|
|
|