An apache2 security update has been released for Debian GNU/Linux 8 Extended LTS to address two vulnerabilities.

WARNING: This package appears to be broken. Apache will fail to restart with "Cannot load /usr/lib/apache2/modules/mod_proxy.so into server: /usr/lib/apache2/modules/mod_proxy.so: undefined symbol: ap_proxy_de_socketfy" error.

A fix is now available:  ELA-567-2 apache2 regression update

ELA-567-1 apache2 security update

Package apache2
Version 2.4.10-10+deb8u20
Related CVEs CVE-2021-44224 CVE-2021-44790

Two vulnerabilities have been discovered in the Apache HTTP server:

CVE-2021-44224

When operating as a forward proxy, Apache was depending on the setup suspectable to denial of service or Server Side Request forgery.
CVE-2021-44790

A buffer overflow in mod_lua may result in denial of service or potentially the execution of arbitrary code.
For Debian 8 jessie, these problems have been fixed in version 2.4.10-10+deb8u20.

We recommend that you upgrade your apache2 packages.

Further information about Extended LTS security advisories can be found at: https://deb.freexian.com/extended-lts/

ELA-567-1 apache2 security update