This website is deprecated, and remains online only for historic access to old issues and docs for historic versions of Virtualmin. It has been unmaintained for several years, and should not be relied on for up-to-date information. Please visit www.virtualmin.com instead.

Apache version

2 posts / 0 new

Topic locked

Last post

#1 Wed, 04/04/2012 - 11:03

MustangV10

Apache version

Hi,

I'm running the latest version of Virtualmin with CentOS 6.2. We're currently running an outdated version of Apache/httpd.

[root@website ~]# httpd -v Server version: Apache/2.2.15 (Unix) Server built: Jan 5 2012 14:12:47 [root@website ~]#

As I can see, the latest version of Apache is 2.4.1

I understand that there are always slight incompatibilities between versions of software releases and that manufacturers don't always compile with the latest version.

However, am I running the latest version supported by Virtualmin?

I just performed a scan with Acunetix, and got this which made me think about it.

===========================================================================

Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script.

Thanks.

#2 Wed, 04/04/2012 - 12:08

andreychek

Howdy,

You're using the most recent version of Apache available to CentOS 6.

CentOS (and RHEL) release a given software version with their distribution, and then they backport bugfixes and security updates to that release.

So you're using the same Apache version as the other CentOS 6 users out there, and it's fully patched -- there aren't any know security holes in it.

-Eric

Topic locked