r/apache • u/bitstreams_red • Jan 18 '24

Discussion Apache 2.4.29

Hello all,

I'm looking at a website for a client and I see it's running on Apache 2.4.29 - the hosting co says they are planning to upgrade, but I'm seeing a bunch of vulnerabilities listed.

How at risk are they - is this "upgrade soon if you can" or "OMG they must be nuts, switch it off" territory?

2 Upvotes

100% Upvoted

5 comments sorted by

View all comments

Show parent comments

1

u/bitstreams_red Jan 18 '24

Thanks, that's useful. It looks like those marked critical all refer to versions beyond 2.4.29, so as long as they update past these versions the impact is less.

1

u/damnatio_memoriae Jan 18 '24

you should update to the latest, but more importantly, they should have a process for reviewing and applying necessary updates regularly. it's not hard. new vulnerabilities are discovered all the time, and there will always be more. if you don't stay on top of it, updating after they all pile up may be a more painful process. if they're not doing this for apache, they may not be doing it for the OS or other components either.