From patchwork Sat Nov 7 22:10:42 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adolf Belka X-Patchwork-Id: 10707 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4jMVcB6hbvz3wvf for ; Sat, 07 Nov 2026 22:10:50 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [IPv6:2001:678:b28::201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "YE2" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4jMVc969Jjz6r4 for ; Sat, 07 Nov 2026 22:10:49 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4jMVc95PrQz32M3 for ; Sat, 07 Nov 2026 22:10:49 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4jMVc71037z2xKC for ; Sat, 07 Nov 2026 22:10:47 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4jMVc65RLGz3rq; Sat, 07 Nov 2026 22:10:46 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1794089446; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=yBJUCwNVF8RXOKdk8pMRtMLrQrs5OKGduTe5IvPEor0=; b=a1iXc+gsLt9mKB4gBZiRB3DE98UiPmUHMS6WYIZKmugiA6EoWTSSCdFW+Q5NQrP89d68RJ kl9b8fOZoZyf7xBw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1794089446; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=yBJUCwNVF8RXOKdk8pMRtMLrQrs5OKGduTe5IvPEor0=; b=ifMKAA3SMYQ0xkMfWfYJP79wnJITwmpSykIcg5FqfS3r1vTkjq0hqsZ+NKrlTm5WqCpvmN VKla0WcHYm7eqRlkvpIywP24DQBX9w/1V4oWlE9SpXx1/evNgfZNUEtsO640dCUjC+8jpr kdJAjx5AorWzDSe/ye801co6xG0zhk1/3zX/CZoFhfJsYcBWx/kMP5ufDJJEMiTiPE9eeb zVPK33L5OJcdr+P10gKYM7VSu42AmEksoRdf2oZs/6Aml841nPIHijX+DKY5SWEHJ+b8VJ dB1DA8p+j4bdkDjABIpIOzZFnqLQWEyc8THUnDLSfgWj2F+CZ8pbWelj1iV9Gw== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH] httpd: Load reqtimeout_module for CVE-2007-6750 Date: Sat, 7 Nov 2026 23:10:42 +0100 Message-ID: <20261107221042.3185967-2-adolf.belka@ipfire.org> In-Reply-To: <20261107221042.3185967-1-adolf.belka@ipfire.org> References: <20261107221042.3185967-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 - In 2010 apache version 2.2.15 was issued to deal with CVE-2007-6750. Looking at the commit this version was a version update and not seen as a CVE fix. The 2.2.15 version provided the reqtimeout_module and it was provided in the apache rootfile. - However it was never added into the loadmodule.conf file and so has never been implemented in IPFire. - A user in the forum flagged this up as an output from an nmap scan that had been run. - Ran the nmap scan and confirmed that it flagged up the slowloris vulnerability. - Added the module into loadmodule.conf and tested it in a vm and re-ran the nmap scan and notrhing was flagged up. - Although this has been present for 16 years, the fact that by default the WUI can not be accessed remotely from the internet and we recommend not to do that likely means that this vulnerability has not beenexposed into the internet. Tested-by: Adolf Belka Signed-off-by: Adolf Belka --- config/httpd/loadmodule.conf | 1 + 1 file changed, 1 insertion(+) diff --git a/config/httpd/loadmodule.conf b/config/httpd/loadmodule.conf index 4947a8a21..4e44feb5a 100644 --- a/config/httpd/loadmodule.conf +++ b/config/httpd/loadmodule.conf @@ -52,3 +52,4 @@ LoadModule alias_module /usr/lib/apache/mod_alias.so LoadModule rewrite_module /usr/lib/apache/mod_rewrite.so LoadModule socache_shmcb_module /usr/lib/apache/mod_socache_shmcb.so LoadModule ssl_module /usr/lib/apache/mod_ssl.so +LoadModule reqtimeout_module /usr/lib/apache/mod_reqtimeout.so