https://bz.apache.org/bugzilla/show_bug.cgi?id=65584
JS <[email protected]> changed: What |Removed |Added ---------------------------------------------------------------------------- Version|2.4.48 |2.4.52 --- Comment #3 from JS <[email protected]> --- I've recently discovered this across various hosts running hpptd between 2.4.6 and 2.4.52. While not causing major issues at this time, it does turn up as an SSRF vulnerability we are unable to resolve on pentests, and there is the heightened possibility of successful DoS attacks due to the extra overhead while httpd issues and waits for a response to the DNS request (particularly if the DNS requests are slow to return for whatever reason, thus holding a thread hostage while it waits to resolve). The expected functionality is that if HostnameLookups is set to "Off" (which it is by default), there wouldn't be any backend DNS requests regardless. Is there going to be a fix for this at any point? If a fix is not going to be provided, the documentation for HostnameLookups should be updated at the very least to point out that the expected behavior does not apply when using mod_remoteip and the RemoteIpHeader directive: https://httpd.apache.org/docs/2.4/mod/core.html#hostnamelookups I note the documentation does already reference an exception to the HostnameLookups behavior when using mod_authz_host, so it would make sense to spell out the exception for this as well. -- You are receiving this mail because: You are the assignee for the bug. --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
