Developers fix multitude of vulnerabilities in Apache HTTP Server

Re:Developers fix multitude of vulnerabilities in Apache HTT... by iBotPeaches on Friday September 24, 2021 @02:00PM (#28645786)

This was an interesting security patch that marked the first time in my memory that updating Apache led to an immediate regression. A few hours after taking this upgrade many systems experienced such strange timeout errors. Connections were low and couldn't pinpoint the misleading behavior that looked like a slowloris attack, with no connections.

Half a day later with no resolution in research a new patch [1] was available and problem resolved.

[1] https://github.com/apache/httpd/commit/8720881b0634383145e87...

[ Parent | on HN ]

Re:Developers fix multitude of vulnerabilities in Apache HTT... by nocsi on Monday September 27, 2021 @09:24AM (#28670349)

It might be because they had patch cycle commitments. Ideally you want this stuff to be tucked into the regular release cycle. It costs companies a shit load of money to release and out of band update, esp when security related

[ Parent | on HN ]

[dead]

Re:Developers fix multitude of vulnerabilities in Apache HTT... by junon on Friday September 24, 2021 @04:45PM (#28647599)

Do you know what security research entails?

[ Parent | on HN ]

Re:Developers fix multitude of vulnerabilities in Apache HTT... by benreesman on Sunday September 26, 2021 @03:17AM (#28659040)

I’m replying to you because the parent is flagged.

I’m not a security guy, but I am a serious generalist and I’ll try my hand at anything.

Except security.

As finely as I try to hone my craft, as much discipline as I bring to it, and as many great results as I’ve produced: computer security is a completely different ballgame.

The guys and gals who are as sophisticated, and diligent, and dedicated, and ultimately humble enough to be serious security pros are a breed apart, and my hat is off to them.

[ Parent | on HN ]