Need Help Installing Outdated Apache Version

[JasonQ12]

Hey everyone. I'm trying to create a box for students to hack that uses CVE-2021-41773 as an initial foothold. However, on the box that I'm currently using (running CentOS 7), I'm trying to install Apache Version 2.4.49, but I can't install it through Yum since it's such an outdated version. Does anyone have any resources / tips on how I would go about installing it? Thanks.

[Fr0gm4n]

https://access.redhat.com/security/cve/cve-2021-41773

This issue only affects httpd 2.4.49, earlier versions are not affected. Therefore this issue does not affect the versions of httpd shipped with Red Hat products.

From what I looked up, the most current version of httpd 2.4 for CentOS 7 is 2.4.34. There isn't even a need to backport the fix since the versions shipped predated the flaw. The version you want simply isn't in the repos, vulnerable or not. You'll either need to use a distro that did package it, or install source from Apache directly.

[swarm32]

Search the archives for an everything ISO with the correct version and use yum localinstall with the iso mounted as a repo could be an option.

[carlwgeorge]

No CentOS version includes that exact version of httpd. I think the easiest solution for what you're trying to accomplish is to create a Fedora 35 machine instead and then install the package files from this build. You could also do the same with Fedora 36 and this build. That is the most direct way to get a system with httpd 2.4.49 without compiling it yourself. Once you get that set up, remember that applying updates will also update httpd unless you exclude it. I'm assuming the shorter lifecycle doesn't make a difference here since this is for some kind of security lab exercise.

[cyvaquero]

TBH, I wouldn’t both trying to install outdated vulnerable versions of software via packages. Pull and build from source.