VDe Vector

Apache releases security update; link to HTTP/2 unconfirmed

The new version of Apache HTTP Server is intended to fix a vulnerability that could allow attackers to execute code remotely.

The Apache HTTP Server project has released version 2.4.71. The vulnerability could allow remote code execution. Whether the problem lies in HTTP/2 has not been confirmed.

Apache HTTP Server is one of the most widely used web servers on the internet. The project announced version 2.4.71 on Wednesday, referring to its own page on security issues. Administrators are advised to review the release and the accompanying security information.

A vulnerability that could allow remote code execution is serious because it enables an attacker to have commands executed on a system without physical access. Which configurations are vulnerable exactly has not been established here.

HTTP/2 is a protocol that enables browsers and servers to exchange data more efficiently. Problems processing HTTP/2 traffic could therefore affect websites and services that use the technology. Not every Apache server uses the same configuration, so the risk varies by installation.

The release announcement does not automatically indicate that all systems have already been attacked. A security update fixes a problem in the software; it does not prove that exploitation has occurred. Checking logs for unusual traffic or suspicious processes may form part of an investigation into possible misuse.

For Dutch companies and public authorities, the key question is which Apache version and modules are running on their systems. Web hosting providers, application managers and suppliers may be involved. The vulnerability is no reason to draw conclusions about a specific company without technical checks.

Respond to this article

← Back to the edition