https://bz.apache.org/bugzilla/show_bug.cgi?id=65584
JS <jocunnin@adobe.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Version|2.4.48 |2.4.52
--- Comment #3 from JS <jocunnin@adobe.com> ---
I've recently discovered this across various hosts running hpptd between 2.4.6
and 2.4.52. While not causing major issues at this time, it does turn up as an
SSRF vulnerability we are unable to resolve on pentests, and there is the
heightened possibility of successful DoS attacks due to the extra overhead
while httpd issues and waits for a response to the DNS request (particularly if
the DNS requests are slow to return for whatever reason, thus holding a thread
hostage while it waits to resolve).
The expected functionality is that if HostnameLookups is set to "Off" (which it
is by default), there wouldn't be any backend DNS requests regardless. Is there
going to be a fix for this at any point?
If a fix is not going to be provided, the documentation for HostnameLookups
should be updated at the very least to point out that the expected behavior
does not apply when using mod_remoteip and the RemoteIpHeader directive:
https://httpd.apache.org/docs/2.4/mod/core.html#hostnamelookups I note the
documentation does already reference an exception to the HostnameLookups
behavior when using mod_authz_host, so it would make sense to spell out the
exception for this as well.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
JS <jocunnin@adobe.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Version|2.4.48 |2.4.52
--- Comment #3 from JS <jocunnin@adobe.com> ---
I've recently discovered this across various hosts running hpptd between 2.4.6
and 2.4.52. While not causing major issues at this time, it does turn up as an
SSRF vulnerability we are unable to resolve on pentests, and there is the
heightened possibility of successful DoS attacks due to the extra overhead
while httpd issues and waits for a response to the DNS request (particularly if
the DNS requests are slow to return for whatever reason, thus holding a thread
hostage while it waits to resolve).
The expected functionality is that if HostnameLookups is set to "Off" (which it
is by default), there wouldn't be any backend DNS requests regardless. Is there
going to be a fix for this at any point?
If a fix is not going to be provided, the documentation for HostnameLookups
should be updated at the very least to point out that the expected behavior
does not apply when using mod_remoteip and the RemoteIpHeader directive:
https://httpd.apache.org/docs/2.4/mod/core.html#hostnamelookups I note the
documentation does already reference an exception to the HostnameLookups
behavior when using mod_authz_host, so it would make sense to spell out the
exception for this as well.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org