From f8c719321e21e611853156ee8675526a2102a376 Mon Sep 17 00:00:00 2001 From: chengyechun Date: Mon, 8 Jul 2024 14:46:36 +0800 Subject: [PATCH] fix CVEs --- ...nadvertent-subst-of-special-filename.patch | 79 ++++ ...4-38473-fix-comparsion-of-local-path.patch | 58 +++ ...24-38473-fix-the-filename-redirected.patch | 216 ++++++++++ ...4-38473-mod_proxy-Fixup-UDS-filename.patch | 236 ++++++++++ ...cape-for-non-proxypass-configuration.patch | 44 ++ ...VE-2024-38475-tighten-up-prefix_stat.patch | 405 ++++++++++++++++++ ..._ex-to-differentiate-trusted-sources.patch | 310 ++++++++++++++ ...rt-CVE-2024-38477-validate-hostsname.patch | 50 +++ ...CVE-2024-39884-maintain-trusted-flag.patch | 309 +++++++++++++ httpd.spec | 19 +- 10 files changed, 1724 insertions(+), 2 deletions(-) create mode 100644 backport-CVE-2024-38473-CVE-2024-39573-block-inadvertent-subst-of-special-filename.patch create mode 100644 backport-CVE-2024-38473-fix-comparsion-of-local-path.patch create mode 100644 backport-CVE-2024-38473-fix-the-filename-redirected.patch create mode 100644 backport-CVE-2024-38473-mod_proxy-Fixup-UDS-filename.patch create mode 100644 backport-CVE-2024-38473-mod_proxy-escape-for-non-proxypass-configuration.patch create mode 100644 backport-CVE-2024-38474-CVE-2024-38475-tighten-up-prefix_stat.patch create mode 100644 backport-CVE-2024-38476-add-ap_set_content_type_ex-to-differentiate-trusted-sources.patch create mode 100644 backport-CVE-2024-38477-validate-hostsname.patch create mode 100644 backport-CVE-2024-39884-maintain-trusted-flag.patch diff --git a/backport-CVE-2024-38473-CVE-2024-39573-block-inadvertent-subst-of-special-filename.patch b/backport-CVE-2024-38473-CVE-2024-39573-block-inadvertent-subst-of-special-filename.patch new file mode 100644 index 0000000..982918d --- /dev/null +++ b/backport-CVE-2024-38473-CVE-2024-39573-block-inadvertent-subst-of-special-filename.patch @@ -0,0 +1,79 @@ +From 93aec0e3ca451bcc97f6d91c14d5399d13a73365 Mon Sep 17 00:00:00 2001 +From: Eric Covener +Date: Tue, 25 Jun 2024 15:28:00 +0000 +Subject: [PATCH] Merge r1918553 from trunk: + +block inadvertent subst of special filenames + ++ cosmetic merge conflicts + + + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918600 13f79535-47bb-0310-9956-ffa450edef68 + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/93aec0e3ca451bcc97f6d91c14d5399d13a73365 + +--- + modules/mappers/mod_rewrite.c | 38 ++++++++++++++++++++++++----------- + 1 file changed, 26 insertions(+), 12 deletions(-) + +diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c +index 0d8a863..7a1c70b 100644 +--- a/modules/mappers/mod_rewrite.c ++++ b/modules/mappers/mod_rewrite.c +@@ -4234,6 +4234,32 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + return 2; + } + ++ /* Add the previously stripped per-directory location prefix, unless ++ * (1) it's an absolute URL path and ++ * (2) it's a full qualified URL ++ */ ++ if (!is_proxyreq && *newuri != '/' && !is_absolute_uri(newuri, NULL)) { ++ if (ctx->perdir) { ++ rewritelog((r, 3, ctx->perdir, "add per-dir prefix: %s -> %s%s", ++ newuri, ctx->perdir, newuri)); ++ ++ newuri = apr_pstrcat(r->pool, ctx->perdir, newuri, NULL); ++ } ++ else if (!(p->flags & (RULEFLAG_PROXY | RULEFLAG_FORCEREDIRECT))) { ++ /* Not an absolute URI-path and the scheme (if any) is unknown, ++ * and it won't be passed to fully_qualify_uri() below either, ++ * so add an implicit '/' prefix. This avoids potentially a common ++ * rule like "RewriteRule ^/some/path(.*) $1" that is given a path ++ * like "/some/pathscheme:..." to produce the fully qualified URL ++ * "scheme:..." which could be misinterpreted later. ++ */ ++ rewritelog((r, 3, ctx->perdir, "add root prefix: %s -> /%s", ++ newuri, newuri)); ++ ++ newuri = apr_pstrcat(r->pool, "/", newuri, NULL); ++ } ++ } ++ + /* Now adjust API's knowledge about r->filename and r->args */ + r->filename = newuri; + +@@ -4243,18 +4269,6 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + + splitout_queryargs(r, p->flags); + +- /* Add the previously stripped per-directory location prefix, unless +- * (1) it's an absolute URL path and +- * (2) it's a full qualified URL +- */ +- if ( ctx->perdir && !is_proxyreq && *r->filename != '/' +- && !is_absolute_uri(r->filename, NULL)) { +- rewritelog((r, 3, ctx->perdir, "add per-dir prefix: %s -> %s%s", +- r->filename, ctx->perdir, r->filename)); +- +- r->filename = apr_pstrcat(r->pool, ctx->perdir, r->filename, NULL); +- } +- + /* If this rule is forced for proxy throughput + * (`RewriteRule ... ... [P]') then emulate mod_proxy's + * URL-to-filename handler to be sure mod_proxy is triggered +-- +2.33.0 + diff --git a/backport-CVE-2024-38473-fix-comparsion-of-local-path.patch b/backport-CVE-2024-38473-fix-comparsion-of-local-path.patch new file mode 100644 index 0000000..2bc27ce --- /dev/null +++ b/backport-CVE-2024-38473-fix-comparsion-of-local-path.patch @@ -0,0 +1,58 @@ +From cc00cf6b4e37370897daddc307bf1deecf8fedfa Mon Sep 17 00:00:00 2001 +From: Eric Covener +Date: Tue, 25 Jun 2024 20:20:05 +0000 +Subject: [PATCH] Merge r1918623 from trunk: + +fix comparison of local path on Windows + +Submitted By: Yann Ylavic + + + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918625 13f79535-47bb-0310-9956-ffa450edef68 + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/cc00cf6b4e37370897daddc307bf1deecf8fedfa + +--- + modules/mappers/mod_rewrite.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c +index 7a1c70b..3b94f06 100644 +--- a/modules/mappers/mod_rewrite.c ++++ b/modules/mappers/mod_rewrite.c +@@ -630,6 +630,19 @@ static unsigned is_absolute_uri(char *uri, int *supportsqs) + return 0; + } + ++static int is_absolute_path(const char *path) ++{ ++#ifndef WIN32 ++ return (path[0] == '/'); ++#else ++#define IS_SLASH(c) ((c) == '/' || (c) == '\\') ++ /* "//", "\\", "x:/" and "x:\" are absolute paths on Windows */ ++ return ((IS_SLASH(path[0]) && path[1] == path[0]) ++ || (apr_isalpha(path[0]) && path[1] == ':' && IS_SLASH(path[2]))); ++#undef IS_SLASH ++#endif ++} ++ + static const char c2x_table[] = "0123456789abcdef"; + + static APR_INLINE unsigned char *c2x(unsigned what, unsigned char prefix, +@@ -4238,7 +4251,9 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + * (1) it's an absolute URL path and + * (2) it's a full qualified URL + */ +- if (!is_proxyreq && *newuri != '/' && !is_absolute_uri(newuri, NULL)) { ++ if (!is_proxyreq ++ && !is_absolute_path(newuri) ++ && !is_absolute_uri(newuri, NULL)) { + if (ctx->perdir) { + rewritelog((r, 3, ctx->perdir, "add per-dir prefix: %s -> %s%s", + newuri, ctx->perdir, newuri)); +-- +2.33.0 + diff --git a/backport-CVE-2024-38473-fix-the-filename-redirected.patch b/backport-CVE-2024-38473-fix-the-filename-redirected.patch new file mode 100644 index 0000000..b663ae5 --- /dev/null +++ b/backport-CVE-2024-38473-fix-the-filename-redirected.patch @@ -0,0 +1,216 @@ +From 4326d6b9041a3bcb9b529f9163d0761c2d760700 Mon Sep 17 00:00:00 2001 +From: Yann Ylavic +Date: Wed, 26 Jun 2024 14:56:47 +0000 +Subject: [PATCH] factor out IS_SLASH, perdir fix + +in per-dir, the filename will be internally redirected, so / is OK too. + + +don't add / to / in the non-perdir + + +match AP_IS_SLASH macro + +followup to 1918651 + + +Merges r1918651, r1918652, r1918663 from trunk +Reviewed by: covener, ylavic, rpluem +GH: close #458 + + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918668 13f79535-47bb-0310-9956-ffa450edef68 + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/4326d6b9041a3bcb9b529f9163d0761c2d760700 + +--- + include/ap_mmn.h | 4 ++-- + include/httpd.h | 11 +++++++++++ + modules/mappers/mod_rewrite.c | 11 ++++------- + server/util.c | 31 ++++++++++--------------------- + 4 files changed, 27 insertions(+), 30 deletions(-) + +diff --git a/include/ap_mmn.h b/include/ap_mmn.h +index d4c444d..3d6d23a 100644 +--- a/include/ap_mmn.h ++++ b/include/ap_mmn.h +@@ -584,7 +584,7 @@ + * 20120211.121 (2.4.51-dev) Add ap_post_read_request() + * 20120211.122 (2.4.51-dev) Add ap_proxy_canonenc_ex + * 20120211.133 (2.4.60-dev) Add ap_proxy_fixup_uds_filename() +- * ++ * 20120211.134 (2.4.60-dev) AP_SLASHES and AP_IS_SLASH + */ + + #define MODULE_MAGIC_COOKIE 0x41503234UL /* "AP24" */ +@@ -592,7 +592,7 @@ + #ifndef MODULE_MAGIC_NUMBER_MAJOR + #define MODULE_MAGIC_NUMBER_MAJOR 20120211 + #endif +-#define MODULE_MAGIC_NUMBER_MINOR 133 /* 0...n */ ++#define MODULE_MAGIC_NUMBER_MINOR 134 /* 0...n */ + + /** + * Determine if the server's current MODULE_MAGIC_NUMBER is at least a +diff --git a/include/httpd.h b/include/httpd.h +index 2057ec3..847b2a9 100644 +--- a/include/httpd.h ++++ b/include/httpd.h +@@ -2590,6 +2590,17 @@ AP_DECLARE(const char *)ap_dir_fnmatch(ap_dir_match_t *w, const char *path, + */ + AP_DECLARE(int) ap_is_chunked(apr_pool_t *p, const char *line); + ++/* Win32/NetWare/OS2 need to check for both forward and back slashes ++ * in ap_normalize_path() and ap_escape_url(). ++ */ ++#ifdef CASE_BLIND_FILESYSTEM ++#define AP_IS_SLASH(s) ((s == '/') || (s == '\\')) ++#define AP_SLASHES "/\\" ++#else ++#define AP_IS_SLASH(s) (s == '/') ++#define AP_SLASHES "/" ++#endif ++ + #ifdef __cplusplus + } + #endif +diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c +index 3b94f06..8a24ccd 100644 +--- a/modules/mappers/mod_rewrite.c ++++ b/modules/mappers/mod_rewrite.c +@@ -632,14 +632,11 @@ static unsigned is_absolute_uri(char *uri, int *supportsqs) + + static int is_absolute_path(const char *path) + { +-#ifndef WIN32 ++#ifndef CASE_BLIND_FILESYSTEM + return (path[0] == '/'); + #else +-#define IS_SLASH(c) ((c) == '/' || (c) == '\\') +- /* "//", "\\", "x:/" and "x:\" are absolute paths on Windows */ +- return ((IS_SLASH(path[0]) && path[1] == path[0]) +- || (apr_isalpha(path[0]) && path[1] == ':' && IS_SLASH(path[2]))); +-#undef IS_SLASH ++ return ((AP_IS_SLASH(path[0]) && path[1] == path[0]) ++ || (apr_isalpha(path[0]) && path[1] == ':' && AP_IS_SLASH(path[2]))); + #endif + } + +@@ -4253,11 +4250,11 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + */ + if (!is_proxyreq + && !is_absolute_path(newuri) ++ && !AP_IS_SLASH(*newuri) + && !is_absolute_uri(newuri, NULL)) { + if (ctx->perdir) { + rewritelog((r, 3, ctx->perdir, "add per-dir prefix: %s -> %s%s", + newuri, ctx->perdir, newuri)); +- + newuri = apr_pstrcat(r->pool, ctx->perdir, newuri, NULL); + } + else if (!(p->flags & (RULEFLAG_PROXY | RULEFLAG_FORCEREDIRECT))) { +diff --git a/server/util.c b/server/util.c +index 1e006a3..fe37c6b 100644 +--- a/server/util.c ++++ b/server/util.c +@@ -75,17 +75,6 @@ + */ + #include "test_char.h" + +-/* Win32/NetWare/OS2 need to check for both forward and back slashes +- * in ap_normalize_path() and ap_escape_url(). +- */ +-#ifdef CASE_BLIND_FILESYSTEM +-#define IS_SLASH(s) ((s == '/') || (s == '\\')) +-#define SLASHES "/\\" +-#else +-#define IS_SLASH(s) (s == '/') +-#define SLASHES "/" +-#endif +- + /* we know core's module_index is 0 */ + #undef APLOG_MODULE_INDEX + #define APLOG_MODULE_INDEX AP_CORE_MODULE_INDEX +@@ -494,7 +483,7 @@ AP_DECLARE(apr_status_t) ap_pregsub_ex(apr_pool_t *p, char **result, + /* Forward declare */ + static char x2c(const char *what); + +-#define IS_SLASH_OR_NUL(s) (s == '\0' || IS_SLASH(s)) ++#define IS_SLASH_OR_NUL(s) (s == '\0' || AP_IS_SLASH(s)) + + /* + * Inspired by mod_jk's jk_servlet_normalize(). +@@ -505,7 +494,7 @@ AP_DECLARE(int) ap_normalize_path(char *path, unsigned int flags) + apr_size_t l = 1, w = 1, n; + int decode_unreserved = (flags & AP_NORMALIZE_DECODE_UNRESERVED) != 0; + +- if (!IS_SLASH(path[0])) { ++ if (!AP_IS_SLASH(path[0])) { + /* Besides "OPTIONS *", a request-target should start with '/' + * per RFC 7230 section 5.3, so anything else is invalid. + */ +@@ -546,12 +535,12 @@ AP_DECLARE(int) ap_normalize_path(char *path, unsigned int flags) + } + } + +- if (w == 0 || IS_SLASH(path[w - 1])) { ++ if (w == 0 || AP_IS_SLASH(path[w - 1])) { + /* Collapse ///// sequences to / */ +- if ((flags & AP_NORMALIZE_MERGE_SLASHES) && IS_SLASH(path[l])) { ++ if ((flags & AP_NORMALIZE_MERGE_SLASHES) && AP_IS_SLASH(path[l])) { + do { + l++; +- } while (IS_SLASH(path[l])); ++ } while (AP_IS_SLASH(path[l])); + continue; + } + +@@ -580,7 +569,7 @@ AP_DECLARE(int) ap_normalize_path(char *path, unsigned int flags) + if (w > 1) { + do { + w--; +- } while (w && !IS_SLASH(path[w - 1])); ++ } while (w && !AP_IS_SLASH(path[w - 1])); + } + else { + /* Already at root, ignore and return a failure +@@ -1916,7 +1905,7 @@ static int unescape_url(char *url, const char *forbid, const char *reserved, + char decoded; + decoded = x2c(y + 1); + if ((decoded == '\0') +- || (forbid_slashes && IS_SLASH(decoded)) ++ || (forbid_slashes && AP_IS_SLASH(decoded)) + || (forbid && ap_strchr_c(forbid, decoded))) { + badpath = 1; + *x = decoded; +@@ -1924,7 +1913,7 @@ static int unescape_url(char *url, const char *forbid, const char *reserved, + } + else if ((keep_unreserved && TEST_CHAR(decoded, + T_URI_UNRESERVED)) +- || (keep_slashes && IS_SLASH(decoded)) ++ || (keep_slashes && AP_IS_SLASH(decoded)) + || (reserved && ap_strchr_c(reserved, decoded))) { + *x++ = *y++; + *x++ = *y++; +@@ -1951,7 +1940,7 @@ static int unescape_url(char *url, const char *forbid, const char *reserved, + AP_DECLARE(int) ap_unescape_url(char *url) + { + /* Traditional */ +- return unescape_url(url, SLASHES, NULL, 0); ++ return unescape_url(url, AP_SLASHES, NULL, 0); + } + AP_DECLARE(int) ap_unescape_url_keep2f(char *url, int decode_slashes) + { +@@ -1961,7 +1950,7 @@ AP_DECLARE(int) ap_unescape_url_keep2f(char *url, int decode_slashes) + return unescape_url(url, NULL, NULL, 0); + } else { + /* reserve (do not decode) encoded slashes */ +- return unescape_url(url, NULL, SLASHES, 0); ++ return unescape_url(url, NULL, AP_SLASHES, 0); + } + } + AP_DECLARE(int) ap_unescape_url_ex(char *url, unsigned int flags) +-- +2.33.0 + diff --git a/backport-CVE-2024-38473-mod_proxy-Fixup-UDS-filename.patch b/backport-CVE-2024-38473-mod_proxy-Fixup-UDS-filename.patch new file mode 100644 index 0000000..ad2b8f2 --- /dev/null +++ b/backport-CVE-2024-38473-mod_proxy-Fixup-UDS-filename.patch @@ -0,0 +1,236 @@ +From 6b8e043ce4f27114e6ae1b8176b629b7cb3fbbce Mon Sep 17 00:00:00 2001 +From: Yann Ylavic +Date: Wed, 26 Jun 2024 14:51:32 +0000 +Subject: [PATCH] mod_proxy: Fixup UDS filename for mod_proxy called through + r->handler. + +* modules/proxy/proxy_util.c: + Export ap_proxy_fixup_uds_filename() from fix_uds_filename. + Call it from ap_proxy_pre_request() even for rewritten balancer workers. + +* modules/proxy/mod_proxy.h: + Declare ap_proxy_fixup_uds_filename() + +* modules/proxy/mod_proxy.c: + Fixup UDS filename from r->handler in proxy_handler(). + +* include/ap_mmn.h: + Bump MMN minor for ap_proxy_fixup_uds_filename() + + +mod_proxy: follow up to r1918626: Simplify ap_proxy_fixup_uds_filename() and callers. + + +Merges r1918626, r1918647 from trunk +GH: closes #457 + + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918666 13f79535-47bb-0310-9956-ffa450edef68 + +Conflict:Version adaptation exists in ap_mmn.h +Reference:https://github.com/apache/httpd/commit/6b8e043ce4f27114e6ae1b8176b629b7cb3fbbce + +--- + include/ap_mmn.h | 3 ++- + modules/proxy/mod_proxy.c | 33 ++++++++++++++++++------------ + modules/proxy/mod_proxy.h | 8 ++++++++ + modules/proxy/proxy_util.c | 41 ++++++++++++++++++++++---------------- + 4 files changed, 54 insertions(+), 31 deletions(-) + +diff --git a/include/ap_mmn.h b/include/ap_mmn.h +index dd469f3..d4c444d 100644 +--- a/include/ap_mmn.h ++++ b/include/ap_mmn.h +@@ -583,6 +583,7 @@ + * AP_NORMALIZE_DROP_PARAMETERS + * 20120211.121 (2.4.51-dev) Add ap_post_read_request() + * 20120211.122 (2.4.51-dev) Add ap_proxy_canonenc_ex ++ * 20120211.133 (2.4.60-dev) Add ap_proxy_fixup_uds_filename() + * + */ + +@@ -591,7 +592,7 @@ + #ifndef MODULE_MAGIC_NUMBER_MAJOR + #define MODULE_MAGIC_NUMBER_MAJOR 20120211 + #endif +-#define MODULE_MAGIC_NUMBER_MINOR 122 /* 0...n */ ++#define MODULE_MAGIC_NUMBER_MINOR 133 /* 0...n */ + + /** + * Determine if the server's current MODULE_MAGIC_NUMBER is at least a +diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c +index cac9adc..8e826e1 100644 +--- a/modules/proxy/mod_proxy.c ++++ b/modules/proxy/mod_proxy.c +@@ -1224,6 +1224,7 @@ static int proxy_fixup(request_rec *r) + + return OK; /* otherwise; we've done the best we can */ + } ++ + /* Send a redirection if the request contains a hostname which is not */ + /* fully qualified, i.e. doesn't have a domain name appended. Some proxy */ + /* servers like Netscape's allow this and access hosts from the local */ +@@ -1277,7 +1278,7 @@ static int proxy_handler(request_rec *r) + ap_get_module_config(sconf, &proxy_module); + apr_array_header_t *proxies = conf->proxies; + struct proxy_remote *ents = (struct proxy_remote *) proxies->elts; +- int i, rc, access_status; ++ int rc = DECLINED, access_status, i; + int direct_connect = 0; + const char *str; + apr_int64_t maxfwd; +@@ -1292,22 +1293,28 @@ static int proxy_handler(request_rec *r) + return DECLINED; + } + +- if (!r->proxyreq) { +- rc = DECLINED; +- /* We may have forced the proxy handler via config or .htaccess */ +- if (r->handler && +- strncmp(r->handler, "proxy:", 6) == 0 && +- strncmp(r->filename, "proxy:", 6) != 0) { +- r->proxyreq = PROXYREQ_REVERSE; +- r->filename = apr_pstrcat(r->pool, r->handler, r->filename, NULL); +- /* Still need to fixup/canonicalize r->filename */ ++ /* We may have forced the proxy handler via config or .htaccess */ ++ if (!r->proxyreq && r->handler && strncmp(r->handler, "proxy:", 6) == 0) { ++ char *old_filename = r->filename; ++ ++ r->proxyreq = PROXYREQ_REVERSE; ++ r->filename = apr_pstrcat(r->pool, r->handler, r->filename, NULL); ++ ++ /* Still need to fixup/canonicalize r->filename */ ++ rc = ap_proxy_fixup_uds_filename(r); ++ if (rc <= OK) { + rc = proxy_fixup(r); + } + if (rc != OK) { +- return rc; ++ r->filename = old_filename; ++ r->proxyreq = 0; + } +- } else if (strncmp(r->filename, "proxy:", 6) != 0) { +- return DECLINED; ++ } ++ else if (r->proxyreq && strncmp(r->filename, "proxy:", 6) == 0) { ++ rc = OK; ++ } ++ if (rc != OK) { ++ return rc; + } + + /* handle max-forwards / OPTIONS / TRACE */ +diff --git a/modules/proxy/mod_proxy.h b/modules/proxy/mod_proxy.h +index ce8183a..20c07ce 100644 +--- a/modules/proxy/mod_proxy.h ++++ b/modules/proxy/mod_proxy.h +@@ -986,6 +986,14 @@ PROXY_DECLARE(proxy_balancer_shared *) ap_proxy_find_balancershm(ap_slotmem_prov + proxy_balancer *balancer, + unsigned int *index); + ++/* ++ * Strip the UDS part of r->filename if any, and put the UDS path in ++ * r->notes ("uds_path") ++ * @param r current request ++ * @return OK if fixed up, DECLINED if not UDS, or an HTTP_XXX error ++ */ ++PROXY_DECLARE(int) ap_proxy_fixup_uds_filename(request_rec *r); ++ + /** + * Get the most suitable worker and/or balancer for the request + * @param worker worker used for processing request +diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c +index 2dee743..ec592cd 100644 +--- a/modules/proxy/proxy_util.c ++++ b/modules/proxy/proxy_util.c +@@ -2310,7 +2310,7 @@ static int ap_proxy_retry_worker(const char *proxy_function, proxy_worker *worke + * were passed a UDS url (eg: from mod_proxy) and adjust uds_path + * as required. + */ +-static int fix_uds_filename(request_rec *r, char **url) ++PROXY_DECLARE(int) ap_proxy_fixup_uds_filename(request_rec *r) + { + char *uds_url = r->filename + 6, *origin_url; + +@@ -2318,7 +2318,6 @@ static int fix_uds_filename(request_rec *r, char **url) + !ap_cstr_casecmpn(uds_url, "unix:", 5) && + (origin_url = ap_strchr(uds_url + 5, '|'))) { + char *uds_path = NULL; +- apr_size_t url_len; + apr_uri_t urisock; + apr_status_t rv; + +@@ -2333,20 +2332,20 @@ static int fix_uds_filename(request_rec *r, char **url) + if (!uds_path) { + ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10292) + "Invalid proxy UDS filename (%s)", r->filename); +- return 0; ++ return HTTP_BAD_REQUEST; + } + apr_table_setn(r->notes, "uds_path", uds_path); + +- /* Remove the UDS path from *url and r->filename */ +- url_len = strlen(origin_url); +- *url = apr_pstrmemdup(r->pool, origin_url, url_len); +- memcpy(uds_url, *url, url_len + 1); +- + ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r, +- "*: rewrite of url due to UDS(%s): %s (%s)", +- uds_path, *url, r->filename); ++ "*: fixup UDS from %s: %s (%s)", ++ r->filename, origin_url, uds_path); ++ ++ /* Overwrite the UDS part in place */ ++ memmove(uds_url, origin_url, strlen(origin_url) + 1); ++ return OK; + } +- return 1; ++ ++ return DECLINED; + } + + PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker, +@@ -2365,9 +2364,6 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker, + ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r, + "%s: found worker %s for %s", + (*worker)->s->scheme, (*worker)->s->name, *url); +- if (!forward && !fix_uds_filename(r, url)) { +- return HTTP_INTERNAL_SERVER_ERROR; +- } + access_status = OK; + } + else if (forward) { +@@ -2397,9 +2393,6 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker, + * regarding the Connection header in the request. + */ + apr_table_setn(r->subprocess_env, "proxy-nokeepalive", "1"); +- if (!fix_uds_filename(r, url)) { +- return HTTP_INTERNAL_SERVER_ERROR; +- } + } + } + } +@@ -2409,6 +2402,20 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker, + "all workers are busy. Unable to serve %s", *url); + access_status = HTTP_SERVICE_UNAVAILABLE; + } ++ ++ if (access_status == OK && r->proxyreq == PROXYREQ_REVERSE) { ++ int rc = ap_proxy_fixup_uds_filename(r); ++ if (ap_is_HTTP_ERROR(rc)) { ++ return rc; ++ } ++ /* If the URL has changed in r->filename, take everything after ++ * the "proxy:" prefix. ++ */ ++ if (rc == OK) { ++ *url = apr_pstrdup(r->pool, r->filename + 6); ++ } ++ } ++ + return access_status; + } + +-- +2.33.0 + diff --git a/backport-CVE-2024-38473-mod_proxy-escape-for-non-proxypass-configuration.patch b/backport-CVE-2024-38473-mod_proxy-escape-for-non-proxypass-configuration.patch new file mode 100644 index 0000000..0cfe443 --- /dev/null +++ b/backport-CVE-2024-38473-mod_proxy-escape-for-non-proxypass-configuration.patch @@ -0,0 +1,44 @@ +From b10cb2d69184843832d501a615abe3e8e5e256dc Mon Sep 17 00:00:00 2001 +From: Eric Covener +Date: Mon, 24 Jun 2024 17:52:31 +0000 +Subject: [PATCH] Merge r1918550 from trunk: + +mod_proxy: escape for non-proxypass configuration + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918559 13f79535-47bb-0310-9956-ffa450edef68 + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/b10cb2d69184843832d501a615abe3e8e5e256dc + +--- + modules/proxy/mod_proxy.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c +index 6717782..cac9adc 100644 +--- a/modules/proxy/mod_proxy.c ++++ b/modules/proxy/mod_proxy.c +@@ -1293,15 +1293,18 @@ static int proxy_handler(request_rec *r) + } + + if (!r->proxyreq) { ++ rc = DECLINED; + /* We may have forced the proxy handler via config or .htaccess */ + if (r->handler && + strncmp(r->handler, "proxy:", 6) == 0 && + strncmp(r->filename, "proxy:", 6) != 0) { + r->proxyreq = PROXYREQ_REVERSE; + r->filename = apr_pstrcat(r->pool, r->handler, r->filename, NULL); ++ /* Still need to fixup/canonicalize r->filename */ ++ rc = proxy_fixup(r); + } +- else { +- return DECLINED; ++ if (rc != OK) { ++ return rc; + } + } else if (strncmp(r->filename, "proxy:", 6) != 0) { + return DECLINED; +-- +2.33.0 + diff --git a/backport-CVE-2024-38474-CVE-2024-38475-tighten-up-prefix_stat.patch b/backport-CVE-2024-38474-CVE-2024-38475-tighten-up-prefix_stat.patch new file mode 100644 index 0000000..aa21184 --- /dev/null +++ b/backport-CVE-2024-38474-CVE-2024-38475-tighten-up-prefix_stat.patch @@ -0,0 +1,405 @@ +From 1feb5e04a4f7b5f3f13cd40f9635144319dcf24a Mon Sep 17 00:00:00 2001 +From: Eric Covener +Date: Mon, 24 Jun 2024 17:58:17 +0000 +Subject: [PATCH] Merge r1918552 from trunk: + +tighten up prefix_stat and %3f handling + +Require opt-ins for unsafe substitutions + + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918561 13f79535-47bb-0310-9956-ffa450edef68 + +Conflict:The XML file does not exist. Therefore, the file is not modified. +Reference:https://github.com/apache/httpd/commit/1feb5e04a4f7b5f3f13cd40f9635144319dcf24a + +--- + modules/mappers/mod_rewrite.c | 151 +++++++++++++++++++++++++++------- + 1 file changed, 123 insertions(+), 28 deletions(-) + +diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c +index 8a24ccd..f7721f7 100644 +--- a/modules/mappers/mod_rewrite.c ++++ b/modules/mappers/mod_rewrite.c +@@ -168,6 +168,8 @@ static const char* really_last_key = "rewrite_really_last"; + #define RULEFLAG_ESCAPENOPLUS (1<<18) + #define RULEFLAG_QSLAST (1<<19) + #define RULEFLAG_QSNONE (1<<20) /* programattic only */ ++#define RULEFLAG_UNSAFE_PREFIX_STAT (1<<22) ++#define RULEFLAG_UNSAFE_ALLOW3F (1<<23) + + /* return code of the rewrite rule + * the result may be escaped - or not +@@ -175,7 +177,7 @@ static const char* really_last_key = "rewrite_really_last"; + #define ACTION_NORMAL (1<<0) + #define ACTION_NOESCAPE (1<<1) + #define ACTION_STATUS (1<<2) +- ++#define ACTION_STATUS_SET (1<<3) + + #define MAPTYPE_TXT (1<<0) + #define MAPTYPE_DBM (1<<1) +@@ -199,6 +201,7 @@ static const char* really_last_key = "rewrite_really_last"; + #define OPTION_IGNORE_INHERIT (1<<8) + #define OPTION_IGNORE_CONTEXT_INFO (1<<9) + #define OPTION_LEGACY_PREFIX_DOCROOT (1<<10) ++#define OPTION_UNSAFE_PREFIX_STAT (1<<12) + + #ifndef RAND_MAX + #define RAND_MAX 32767 +@@ -292,6 +295,14 @@ typedef enum { + CONDPAT_AP_EXPR + } pattern_type; + ++typedef enum { ++ RULE_RC_NOMATCH = 0, /* the rule didn't match */ ++ RULE_RC_MATCH = 1, /* a matching rule w/ substitution */ ++ RULE_RC_NOSUB = 2, /* a matching rule w/ no substitution */ ++ RULE_RC_STATUS_SET = 3 /* a matching rule that has set an HTTP error ++ to be returned in r->status */ ++} rule_return_type; ++ + typedef struct { + char *input; /* Input string of RewriteCond */ + char *pattern; /* the RegExp pattern string */ +@@ -933,10 +944,15 @@ static void fully_qualify_uri(request_rec *r) + return; + } + ++static int startsWith(request_rec *r, const char *haystack, const char *needle) { ++ int rc = (ap_strstr_c(haystack, needle) == haystack); ++ rewritelog((r, 5, NULL, "prefix_stat startsWith(%s, %s) %d", haystack, needle, rc)); ++ return rc; ++} + /* +- * stat() only the first segment of a path ++ * stat() only the first segment of a path, and only if it matches the output of the last matching rule + */ +-static int prefix_stat(const char *path, apr_pool_t *pool) ++static int prefix_stat(request_rec *r, const char *path, apr_pool_t *pool, rewriterule_entry *lastsub) + { + const char *curpath = path; + const char *root; +@@ -970,10 +986,36 @@ static int prefix_stat(const char *path, apr_pool_t *pool) + apr_finfo_t sb; + + if (apr_stat(&sb, statpath, APR_FINFO_MIN, pool) == APR_SUCCESS) { +- return 1; ++ if (!lastsub) { ++ rewritelog((r, 3, NULL, "prefix_stat no lastsub subst prefix %s", statpath)); ++ return 1; ++ } ++ ++ rewritelog((r, 3, NULL, "prefix_stat compare statpath %s and lastsub output %s STATOK %d ", ++ statpath, lastsub->output, lastsub->flags & RULEFLAG_UNSAFE_PREFIX_STAT)); ++ if (lastsub->flags & RULEFLAG_UNSAFE_PREFIX_STAT) { ++ return 1; ++ } ++ else { ++ const char *docroot = ap_document_root(r); ++ const char *context_docroot = ap_context_document_root(r); ++ /* ++ * As an example, path (r->filename) is /var/foo/bar/baz.html ++ * even if the flag is not set, we can accept a rule that ++ * began with a literal /var (stapath), or if the entire path ++ * starts with the docroot or context document root ++ */ ++ if (startsWith(r, lastsub->output, statpath) || ++ startsWith(r, path, docroot) || ++ ((docroot != context_docroot) && ++ startsWith(r, path, context_docroot))) { ++ return 1; ++ } ++ } + } + } + ++ /* prefix will be added */ + return 0; + } + +@@ -3058,6 +3100,9 @@ static const char *cmd_rewriteoptions(cmd_parms *cmd, + else if (!strcasecmp(w, "legacyprefixdocroot")) { + options |= OPTION_LEGACY_PREFIX_DOCROOT; + } ++ else if (!strcasecmp(w, "UnsafePrefixStat")) { ++ options |= OPTION_UNSAFE_PREFIX_STAT; ++ } + else { + return apr_pstrcat(cmd->pool, "RewriteOptions: unknown option '", + w, "'", NULL); +@@ -3755,6 +3800,18 @@ static const char *cmd_rewriterule_setflag(apr_pool_t *p, void *_cfg, + ++error; + } + break; ++ case 'u': ++ case 'U': ++ if (!strcasecmp(key, "nsafePrefixStat")){ ++ cfg->flags |= (RULEFLAG_UNSAFE_PREFIX_STAT); ++ } ++ else if(!strcasecmp(key, "nsafeAllow3F")) { ++ cfg->flags |= RULEFLAG_UNSAFE_ALLOW3F; ++ } ++ else { ++ ++error; ++ } ++ break; + default: + ++error; + break; +@@ -4102,7 +4159,8 @@ static APR_INLINE void force_type_handler(rewriterule_entry *p, + /* + * Apply a single RewriteRule + */ +-static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) ++static rule_return_type apply_rewrite_rule(rewriterule_entry *p, ++ rewrite_ctx *ctx) + { + ap_regmatch_t regmatch[AP_MAX_REG_MATCH]; + apr_array_header_t *rewriteconds; +@@ -4153,7 +4211,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + rc = !ap_regexec(p->regexp, ctx->uri, AP_MAX_REG_MATCH, regmatch, 0); + if (! (( rc && !(p->flags & RULEFLAG_NOTMATCH)) || + (!rc && (p->flags & RULEFLAG_NOTMATCH)) ) ) { +- return 0; ++ return RULE_RC_NOMATCH; + } + + /* It matched, wow! Now it's time to prepare the context structure for +@@ -4204,7 +4262,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + } + } + else if (!rc) { +- return 0; ++ return RULE_RC_NOMATCH; + } + + /* If some HTTP header was involved in the condition, remember it +@@ -4224,6 +4282,15 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + newuri = do_expand(p->output, ctx, p); + rewritelog((r, 2, ctx->perdir, "rewrite '%s' -> '%s'", ctx->uri, + newuri)); ++ if (!(p->flags & RULEFLAG_UNSAFE_ALLOW3F) && ++ ap_strcasestr(r->unparsed_uri, "%3f") && ++ ap_strchr_c(newuri, '?')) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO() ++ "Unsafe URL with %%3f URL rewritten without " ++ "UnsafeAllow3F"); ++ r->status = HTTP_FORBIDDEN; ++ return RULE_RC_STATUS_SET; ++ } + } + + /* expand [E=var:val] and [CO=] */ +@@ -4241,7 +4308,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + r->status = p->forced_responsecode; + } + +- return 2; ++ return RULE_RC_NOSUB; + } + + /* Add the previously stripped per-directory location prefix, unless +@@ -4309,7 +4376,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + r->filename)); + + r->filename = apr_pstrcat(r->pool, "proxy:", r->filename, NULL); +- return 1; ++ return RULE_RC_MATCH; + } + + /* If this rule is explicitly forced for HTTP redirection +@@ -4324,7 +4391,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + r->filename)); + + r->status = p->forced_responsecode; +- return 1; ++ return RULE_RC_MATCH; + } + + /* Special Rewriting Feature: Self-Reduction +@@ -4346,7 +4413,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + "with %s", p->forced_responsecode, r->filename)); + + r->status = p->forced_responsecode; +- return 1; ++ return RULE_RC_MATCH; + } + + /* Finally remember the forced mime-type */ +@@ -4355,7 +4422,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + /* Puuhhhhhhhh... WHAT COMPLICATED STUFF ;_) + * But now we're done for this particular rule. + */ +- return 1; ++ return RULE_RC_MATCH; + } + + /* +@@ -4363,13 +4430,13 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + * i.e. a list of rewrite rules + */ + static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules, +- char *perdir) ++ char *perdir, rewriterule_entry **lastsub) + { + rewriterule_entry *entries; + rewriterule_entry *p; + int i; + int changed; +- int rc; ++ rule_return_type rc; + int s; + rewrite_ctx *ctx; + int round = 1; +@@ -4377,6 +4444,7 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules, + ctx = apr_palloc(r->pool, sizeof(*ctx)); + ctx->perdir = perdir; + ctx->r = r; ++ *lastsub = NULL; + + /* + * Iterate over all existing rules +@@ -4404,7 +4472,12 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules, + ctx->vary = NULL; + rc = apply_rewrite_rule(p, ctx); + +- if (rc) { ++ if (rc != RULE_RC_NOMATCH) { ++ ++ if (!(p->flags & RULEFLAG_NOSUB)) { ++ rewritelog((r, 2, perdir, "setting lastsub to rule with output %s", p->output)); ++ *lastsub = p; ++ } + + /* Catch looping rules with pathinfo growing unbounded */ + if ( strlen( r->filename ) > 2*r->server->limit_req_line ) { +@@ -4424,6 +4497,12 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules, + apr_table_merge(r->headers_out, "Vary", ctx->vary); + } + ++ ++ /* Error while evaluating rule, r->status set */ ++ if (RULE_RC_STATUS_SET == rc) { ++ return ACTION_STATUS_SET; ++ } ++ + /* + * The rule sets the response code (implies match-only) + */ +@@ -4434,7 +4513,7 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules, + /* + * Indicate a change if this was not a match-only rule. + */ +- if (rc != 2) { ++ if (rc != RULE_RC_NOSUB) { + changed = ((p->flags & RULEFLAG_NOESCAPE) + ? ACTION_NOESCAPE : ACTION_NORMAL); + } +@@ -4623,6 +4702,7 @@ static int hook_uri2file(request_rec *r) + int rulestatus; + void *skipdata; + const char *oargs; ++ rewriterule_entry *lastsub = NULL; + + /* + * retrieve the config structures +@@ -4734,7 +4814,7 @@ static int hook_uri2file(request_rec *r) + /* + * now apply the rules ... + */ +- rulestatus = apply_rewrite_list(r, conf->rewriterules, NULL); ++ rulestatus = apply_rewrite_list(r, conf->rewriterules, NULL, &lastsub); + apr_table_setn(r->notes, "mod_rewrite_rewritten", + apr_psprintf(r->pool,"%d",rulestatus)); + } +@@ -4766,6 +4846,9 @@ static int hook_uri2file(request_rec *r) + r->status = HTTP_OK; + return n; + } ++ else if (ACTION_STATUS_SET == rulestatus) { ++ return r->status; ++ } + + flen = r->filename ? strlen(r->filename) : 0; + if (flen > 6 && strncmp(r->filename, "proxy:", 6) == 0) { +@@ -4886,23 +4969,29 @@ static int hook_uri2file(request_rec *r) + return HTTP_BAD_REQUEST; + } + +- /* if there is no valid prefix, we call +- * the translator from the core and +- * prefix the filename with document_root ++ /* We have r->filename as a path in a server-context rewrite without ++ * the PT flag. The historical behavior is to treat it as a verbatim ++ * filesystem path iff the first component of the path exists and is ++ * readable by httpd. Otherwise, it is interpreted as DocumentRoot ++ * relative. + * + * NOTICE: + * We cannot leave out the prefix_stat because +- * - when we always prefix with document_root +- * then no absolute path can be created, e.g. via +- * emulating a ScriptAlias directive, etc. +- * - when we always NOT prefix with document_root ++ * - If we always prefix with document_root ++ * then no absolute path can could ever be used in ++ * a substitution. e.g. emulating an Alias. ++ * - If we never prefix with document_root + * then the files under document_root have to + * be references directly and document_root + * gets never used and will be a dummy parameter - +- * this is also bad ++ * this is also bad. ++ * - Later addition: This part is questionable. ++ * If we had never prefixed, users would just ++ * need %{DOCUMENT_ROOT} in substitutions or the ++ * [PT] flag. + * + * BUT: +- * Under real Unix systems this is no problem, ++ * Under real Unix systems this is no perf problem, + * because we only do stat() on the first directory + * and this gets cached by the kernel for along time! + */ +@@ -4911,7 +5000,9 @@ static int hook_uri2file(request_rec *r) + uri_reduced = apr_table_get(r->notes, "mod_rewrite_uri_reduced"); + } + +- if (!prefix_stat(r->filename, r->pool) || uri_reduced != NULL) { ++ if (!prefix_stat(r, r->filename, r->pool, ++ conf->options & OPTION_UNSAFE_PREFIX_STAT ? NULL : lastsub) ++ || uri_reduced != NULL) { + int res; + char *tmp = r->uri; + +@@ -4956,6 +5047,7 @@ static int hook_fixup(request_rec *r) + char *ofilename, *oargs; + int is_proxyreq; + void *skipdata; ++ rewriterule_entry *lastsub; + + dconf = (rewrite_perdir_conf *)ap_get_module_config(r->per_dir_config, + &rewrite_module); +@@ -5040,7 +5132,7 @@ static int hook_fixup(request_rec *r) + /* + * now apply the rules ... + */ +- rulestatus = apply_rewrite_list(r, dconf->rewriterules, dconf->directory); ++ rulestatus = apply_rewrite_list(r, dconf->rewriterules, dconf->directory, &lastsub); + if (rulestatus) { + unsigned skip; + +@@ -5061,6 +5153,9 @@ static int hook_fixup(request_rec *r) + r->status = HTTP_OK; + return n; + } ++ else if (ACTION_STATUS_SET == rulestatus) { ++ return r->status; ++ } + + l = strlen(r->filename); + if (l > 6 && strncmp(r->filename, "proxy:", 6) == 0) { +-- +2.33.0 + diff --git a/backport-CVE-2024-38476-add-ap_set_content_type_ex-to-differentiate-trusted-sources.patch b/backport-CVE-2024-38476-add-ap_set_content_type_ex-to-differentiate-trusted-sources.patch new file mode 100644 index 0000000..775747f --- /dev/null +++ b/backport-CVE-2024-38476-add-ap_set_content_type_ex-to-differentiate-trusted-sources.patch @@ -0,0 +1,310 @@ +From 554554b0ebb14d6578adb70a389c57a0d5f18a3b Mon Sep 17 00:00:00 2001 +From: Eric Covener +Date: Mon, 24 Jun 2024 17:54:34 +0000 +Subject: [PATCH] Merge r1918551 from trunk: + +add ap_set_content_type_ex to differentiate + +trusted sources + + + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918560 13f79535-47bb-0310-9956-ffa450edef68 + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/554554b0ebb14d6578adb70a389c57a0d5f18a3b + +--- + include/http_protocol.h | 11 +++++++++++ + include/httpd.h | 7 +++++++ + modules/http/http_protocol.c | 6 ++++++ + modules/http/mod_mime.c | 20 ++++++++++---------- + modules/mappers/mod_actions.c | 6 ++++-- + modules/mappers/mod_negotiation.c | 8 ++++---- + modules/mappers/mod_rewrite.c | 2 +- + modules/metadata/mod_headers.c | 6 +++--- + modules/metadata/mod_mime_magic.c | 4 ++-- + server/config.c | 2 +- + server/core.c | 2 +- + 11 files changed, 50 insertions(+), 24 deletions(-) + +diff --git a/include/http_protocol.h b/include/http_protocol.h +index 94c481e..f2c99c9 100644 +--- a/include/http_protocol.h ++++ b/include/http_protocol.h +@@ -438,6 +438,17 @@ AP_DECLARE(void) ap_clear_method_list(ap_method_list_t *l); + */ + AP_DECLARE(void) ap_set_content_type(request_rec *r, const char *ct); + ++/** ++ * Set the content type for this request (r->content_type). ++ * @param r The current request ++ * @param ct The new content type ++ * @param trusted If non-zero, The content-type should come from a ++ * trusted source such as server configuration rather ++ * than application output. ++ * for the AddOutputFilterByType directive to work correctly. ++ */ ++AP_DECLARE(void) ap_set_content_type_ex(request_rec *r, const char *ct, int trusted); ++ + /** + * Set the Accept-Ranges header for this response + * @param r The current request +diff --git a/include/httpd.h b/include/httpd.h +index 847b2a9..5e518d1 100644 +--- a/include/httpd.h ++++ b/include/httpd.h +@@ -666,6 +666,7 @@ typedef apr_uint64_t ap_request_bnotes_t; + * + */ + #define AP_REQUEST_STRONG_ETAG 1 >> 0 ++#define AP_REQUEST_TRUSTED_CT 1 << 1 + + /** + * This is a convenience macro to ease with getting specific request +@@ -688,6 +689,12 @@ typedef apr_uint64_t ap_request_bnotes_t; + AP_REQUEST_GET_BNOTE((r), AP_REQUEST_STRONG_ETAG) + /** @} */ + ++/** ++ * Returns true if the content-type field is from a trusted source ++ */ ++#define AP_REQUEST_IS_TRUSTED_CT(r) \ ++ (!!AP_REQUEST_GET_BNOTE((r), AP_REQUEST_TRUSTED_CT)) ++/** @} */ + + /** + * @defgroup module_magic Module Magic mime types +diff --git a/modules/http/http_protocol.c b/modules/http/http_protocol.c +index d031f24..c31e873 100644 +--- a/modules/http/http_protocol.c ++++ b/modules/http/http_protocol.c +@@ -1097,8 +1097,14 @@ AP_DECLARE(void) ap_set_content_type(request_rec *r, const char *ct) + } + else if (!r->content_type || strcmp(r->content_type, ct)) { + r->content_type = ct; ++ AP_REQUEST_SET_BNOTE(r, AP_REQUEST_TRUSTED_CT, 0); + } + } ++AP_DECLARE(void) ap_set_content_type_ex(request_rec *r, const char *ct, int trusted) ++{ ++ ap_set_content_type(r, ct); ++ AP_REQUEST_SET_BNOTE(r, AP_REQUEST_TRUSTED_CT, trusted ? AP_REQUEST_TRUSTED_CT : 0); ++} + + AP_DECLARE(void) ap_set_accept_ranges(request_rec *r) + { +diff --git a/modules/http/mod_mime.c b/modules/http/mod_mime.c +index 700f824..51095a0 100644 +--- a/modules/http/mod_mime.c ++++ b/modules/http/mod_mime.c +@@ -759,7 +759,7 @@ static int find_ct(request_rec *r) + int found_metadata = 0; + + if (r->finfo.filetype == APR_DIR) { +- ap_set_content_type(r, DIR_MAGIC_TYPE); ++ ap_set_content_type_ex(r, DIR_MAGIC_TYPE, 1); + return OK; + } + +@@ -850,7 +850,7 @@ static int find_ct(request_rec *r) + if (exinfo == NULL || !exinfo->forced_type) { + if ((type = apr_hash_get(mime_type_extensions, ext, + APR_HASH_KEY_STRING)) != NULL) { +- ap_set_content_type(r, (char*) type); ++ ap_set_content_type_ex(r, (char*) type, 1); + found = 1; + } + } +@@ -859,7 +859,7 @@ static int find_ct(request_rec *r) + + /* empty string is treated as special case for RemoveType */ + if (exinfo->forced_type && *exinfo->forced_type) { +- ap_set_content_type(r, exinfo->forced_type); ++ ap_set_content_type_ex(r, exinfo->forced_type, 1); + found = 1; + } + +@@ -964,33 +964,33 @@ static int find_ct(request_rec *r) + memcpy(tmp, ctp->subtype, ctp->subtype_len); + tmp += ctp->subtype_len; + *tmp = 0; +- ap_set_content_type(r, base_content_type); ++ ap_set_content_type_ex(r, base_content_type, AP_REQUEST_IS_TRUSTED_CT(r)); + while (pp != NULL) { + if (charset && !strcmp(pp->attr, "charset")) { + if (!override) { +- ap_set_content_type(r, ++ ap_set_content_type_ex(r, + apr_pstrcat(r->pool, + r->content_type, + "; charset=", + charset, +- NULL)); ++ NULL), AP_REQUEST_IS_TRUSTED_CT(r)); + override = 1; + } + } + else { +- ap_set_content_type(r, ++ ap_set_content_type_ex(r, + apr_pstrcat(r->pool, + r->content_type, + "; ", pp->attr, + "=", pp->val, +- NULL)); ++ NULL), AP_REQUEST_IS_TRUSTED_CT(r)); + } + pp = pp->next; + } + if (charset && !override) { +- ap_set_content_type(r, apr_pstrcat(r->pool, r->content_type, ++ ap_set_content_type_ex(r, apr_pstrcat(r->pool, r->content_type, + "; charset=", charset, +- NULL)); ++ NULL), AP_REQUEST_IS_TRUSTED_CT(r)); + } + } + } +diff --git a/modules/mappers/mod_actions.c b/modules/mappers/mod_actions.c +index ac9c3b7..5e398b5 100644 +--- a/modules/mappers/mod_actions.c ++++ b/modules/mappers/mod_actions.c +@@ -182,8 +182,10 @@ static int action_handler(request_rec *r) + return DECLINED; + + /* Second, check for actions (which override the method scripts) */ +- action = r->handler ? r->handler : +- ap_field_noparam(r->pool, r->content_type); ++ action = r->handler; ++ if (!action && AP_REQUEST_IS_TRUSTED_CT(r)) { ++ action = ap_field_noparam(r->pool, r->content_type); ++ } + + if (action && (t = apr_table_get(conf->action_types, action))) { + int virtual = (*t++ == '0' ? 0 : 1); +diff --git a/modules/mappers/mod_negotiation.c b/modules/mappers/mod_negotiation.c +index c056b28..a528f81 100644 +--- a/modules/mappers/mod_negotiation.c ++++ b/modules/mappers/mod_negotiation.c +@@ -1167,7 +1167,7 @@ static int read_types_multi(negotiation_state *neg) + * might be doing. + */ + if (sub_req->handler && !sub_req->content_type) { +- ap_set_content_type(sub_req, CGI_MAGIC_TYPE); ++ ap_set_content_type_ex(sub_req, CGI_MAGIC_TYPE, 1); + } + + /* +@@ -3003,14 +3003,14 @@ static int handle_map_file(request_rec *r) + /* set MIME type and charset as negotiated */ + if (best->mime_type && *best->mime_type) { + if (best->content_charset && *best->content_charset) { +- ap_set_content_type(r, apr_pstrcat(r->pool, ++ ap_set_content_type_ex(r, apr_pstrcat(r->pool, + best->mime_type, + "; charset=", + best->content_charset, +- NULL)); ++ NULL), 1); + } + else { +- ap_set_content_type(r, apr_pstrdup(r->pool, best->mime_type)); ++ ap_set_content_type_ex(r, apr_pstrdup(r->pool, best->mime_type), 1); + } + } + +diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c +index f7721f7..0396fa1 100644 +--- a/modules/mappers/mod_rewrite.c ++++ b/modules/mappers/mod_rewrite.c +@@ -5396,7 +5396,7 @@ static int hook_mimetype(request_rec *r) + rewritelog((r, 1, NULL, "force filename %s to have MIME-type '%s'", + r->filename, t)); + +- ap_set_content_type(r, t); ++ ap_set_content_type_ex(r, t, 1); + } + + /* handler */ +diff --git a/modules/metadata/mod_headers.c b/modules/metadata/mod_headers.c +index ef812cd..4838bd6 100644 +--- a/modules/metadata/mod_headers.c ++++ b/modules/metadata/mod_headers.c +@@ -783,14 +783,14 @@ static int do_headers_fixup(request_rec *r, apr_table_t *headers, + break; + case hdr_set: + if (!ap_cstr_casecmp(hdr->header, "Content-Type")) { +- ap_set_content_type(r, process_tags(hdr, r)); ++ ap_set_content_type_ex(r, process_tags(hdr, r), 1); + } + apr_table_setn(headers, hdr->header, process_tags(hdr, r)); + break; + case hdr_setifempty: + if (NULL == apr_table_get(headers, hdr->header)) { + if (!ap_cstr_casecmp(hdr->header, "Content-Type")) { +- ap_set_content_type(r, process_tags(hdr, r)); ++ ap_set_content_type_ex(r, process_tags(hdr, r), 1); + } + apr_table_setn(headers, hdr->header, process_tags(hdr, r)); + } +@@ -809,7 +809,7 @@ static int do_headers_fixup(request_rec *r, apr_table_t *headers, + const char *repl = process_regexp(hdr, r->content_type, r); + if (repl == NULL) + return 0; +- ap_set_content_type(r, repl); ++ ap_set_content_type_ex(r, repl, 1); + } + if (apr_table_get(headers, hdr->header)) { + edit_do ed; +diff --git a/modules/metadata/mod_mime_magic.c b/modules/metadata/mod_mime_magic.c +index 7dac4fd..1c96db4 100644 +--- a/modules/metadata/mod_mime_magic.c ++++ b/modules/metadata/mod_mime_magic.c +@@ -788,7 +788,7 @@ static int magic_rsl_to_request(request_rec *r) + /* XXX: this could be done at config time I'm sure... but I'm + * confused by all this magic_rsl stuff. -djg */ + ap_content_type_tolower(tmp); +- ap_set_content_type(r, tmp); ++ ap_set_content_type_ex(r, tmp, 1); + + if (state == rsl_encoding) { + tmp = rsl_strdup(r, encoding_frag, +@@ -2326,7 +2326,7 @@ static int revision_suffix(request_rec *r) + + /* extract content type/encoding/language from sub-request */ + if (sub->content_type) { +- ap_set_content_type(r, apr_pstrdup(r->pool, sub->content_type)); ++ ap_set_content_type_ex(r, apr_pstrdup(r->pool, sub->content_type), 1); + #if MIME_MAGIC_DEBUG + ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(01557) + MODNAME ": subrequest %s got %s", +diff --git a/server/config.c b/server/config.c +index be889db..ac5a83f 100644 +--- a/server/config.c ++++ b/server/config.c +@@ -418,7 +418,7 @@ AP_CORE_DECLARE(int) ap_invoke_handler(request_rec *r) + } + + if (!r->handler) { +- if (r->content_type) { ++ if (r->content_type && AP_REQUEST_IS_TRUSTED_CT(r)) { + handler = r->content_type; + if ((p=ap_strchr_c(handler, ';')) != NULL) { + char *new_handler = (char *)apr_pmemdup(r->pool, handler, +diff --git a/server/core.c b/server/core.c +index 515047b..279f648 100644 +--- a/server/core.c ++++ b/server/core.c +@@ -4803,7 +4803,7 @@ static int core_override_type(request_rec *r) + /* Check for overrides with ForceType / SetHandler + */ + if (conf->mime_type && strcmp(conf->mime_type, "none")) +- ap_set_content_type(r, (char*) conf->mime_type); ++ ap_set_content_type_ex(r, (char*) conf->mime_type, 1); + + if (conf->expr_handler) { + const char *err; +-- +2.33.0 + diff --git a/backport-CVE-2024-38477-validate-hostsname.patch b/backport-CVE-2024-38477-validate-hostsname.patch new file mode 100644 index 0000000..b54c30b --- /dev/null +++ b/backport-CVE-2024-38477-validate-hostsname.patch @@ -0,0 +1,50 @@ +From 1d98d4db186e708f059336fb9342d0adb6925e85 Mon Sep 17 00:00:00 2001 +From: Eric Covener +Date: Tue, 25 Jun 2024 17:29:32 +0000 +Subject: [PATCH] Merge r1918606 from trunk: + +validate hostname + + + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918607 13f79535-47bb-0310-9956-ffa450edef68 + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/1d98d4db186e708f059336fb9342d0adb6925e85 + +--- + modules/proxy/proxy_util.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c +index 12b1d6d..41852cb 100644 +--- a/modules/proxy/proxy_util.c ++++ b/modules/proxy/proxy_util.c +@@ -2617,6 +2617,13 @@ ap_proxy_determine_connection(apr_pool_t *p, request_rec *r, + apr_pstrcat(p,"URI cannot be parsed: ", *url, + NULL)); + } ++ ++ if (!uri->hostname) { ++ return ap_proxyerror(r, HTTP_BAD_REQUEST, ++ apr_pstrcat(p,"URI has no hostname: ", *url, ++ NULL)); ++ } ++ + if (!uri->port) { + uri->port = ap_proxy_port_of_scheme(uri->scheme); + } +@@ -3976,6 +3983,10 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p, + * way. No telling which legacy backend is relying no this. + */ + if (dconf->preserve_host == 0) { ++ if (!uri->hostname) { ++ rc = HTTP_BAD_REQUEST; ++ goto cleanup; ++ } + if (ap_strchr_c(uri->hostname, ':')) { /* if literal IPv6 address */ + if (uri->port_str && uri->port != DEFAULT_HTTP_PORT) { + buf = apr_pstrcat(p, "Host: [", uri->hostname, "]:", +-- +2.33.0 + diff --git a/backport-CVE-2024-39884-maintain-trusted-flag.patch b/backport-CVE-2024-39884-maintain-trusted-flag.patch new file mode 100644 index 0000000..0057211 --- /dev/null +++ b/backport-CVE-2024-39884-maintain-trusted-flag.patch @@ -0,0 +1,309 @@ +From fe171ffdf85cdfc3f6f44e8dd0ee3d5e3e6a0d1d Mon Sep 17 00:00:00 2001 +From: Eric Covener +Date: Tue, 2 Jul 2024 13:07:17 +0000 +Subject: [PATCH] Merge r1918795, r1918814 from trunk: + +maintain trusted flag + + +* Always trust content types that we set literally + +Submitted by: covener, rpluem +Reviewed by: covener, jorton, rpluem + +Github: closes #459 + + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918839 13f79535-47bb-0310-9956-ffa450edef68 + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/fe171ffdf85cdfc3f6f44e8dd0ee3d5e3e6a0d1d + +--- + modules/cluster/mod_heartmonitor.c | 2 +- + modules/dav/main/mod_dav.c | 10 +++++----- + modules/examples/mod_example_hooks.c | 2 +- + modules/filters/mod_data.c | 2 +- + modules/filters/mod_include.c | 2 +- + modules/filters/mod_proxy_html.c | 4 ++-- + modules/generators/mod_cgi.c | 2 +- + modules/generators/mod_cgid.c | 2 +- + modules/generators/mod_info.c | 2 +- + modules/generators/mod_status.c | 4 ++-- + modules/http/http_filters.c | 2 +- + modules/http/http_protocol.c | 4 ++-- + modules/http/http_request.c | 2 +- + modules/ldap/util_ldap.c | 2 +- + modules/mappers/mod_imagemap.c | 2 +- + modules/proxy/mod_proxy_balancer.c | 2 +- + 16 files changed, 23 insertions(+), 23 deletions(-) + +diff --git a/modules/cluster/mod_heartmonitor.c b/modules/cluster/mod_heartmonitor.c +index 30db11a..0985d2d 100644 +--- a/modules/cluster/mod_heartmonitor.c ++++ b/modules/cluster/mod_heartmonitor.c +@@ -782,7 +782,7 @@ static int hm_handler(request_rec *r) + hmserver.seen = apr_time_now(); + hm_update_stat(ctx, &hmserver, r->pool); + +- ap_set_content_type(r, "text/plain"); ++ ap_set_content_type_ex(r, "text/plain", 1); + ap_set_content_length(r, 2); + ap_rputs("OK", r); + ap_rflush(r); +diff --git a/modules/dav/main/mod_dav.c b/modules/dav/main/mod_dav.c +index 76d9a51..ee866a6 100644 +--- a/modules/dav/main/mod_dav.c ++++ b/modules/dav/main/mod_dav.c +@@ -323,7 +323,7 @@ static int dav_error_response(request_rec *r, int status, const char *body) + r->status = status; + r->status_line = ap_get_status_line(status); + +- ap_set_content_type(r, "text/html; charset=ISO-8859-1"); ++ ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1); + + /* begin the response now... */ + ap_rvputs(r, +@@ -354,7 +354,7 @@ static int dav_error_response_tag(request_rec *r, + { + r->status = err->status; + +- ap_set_content_type(r, DAV_XML_CONTENT_TYPE); ++ ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1); + + ap_rputs(DAV_XML_HEADER DEBUG_CR + "status = status; +- ap_set_content_type(r, DAV_XML_CONTENT_TYPE); ++ ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1); + + /* Send the headers and actual multistatus response now... */ + ap_fputs(r->output_filters, bb, DAV_XML_HEADER DEBUG_CR +@@ -1963,7 +1963,7 @@ static int dav_method_options(request_rec *r) + + /* send the options response */ + r->status = HTTP_OK; +- ap_set_content_type(r, DAV_XML_CONTENT_TYPE); ++ ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1); + + /* send the headers and response body */ + ap_rputs(DAV_XML_HEADER DEBUG_CR +@@ -3268,7 +3268,7 @@ static int dav_method_lock(request_rec *r) + (*locks_hooks->close_lockdb)(lockdb); + + r->status = HTTP_OK; +- ap_set_content_type(r, DAV_XML_CONTENT_TYPE); ++ ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1); + + ap_rputs(DAV_XML_HEADER DEBUG_CR "" DEBUG_CR, r); + if (lock == NULL) +diff --git a/modules/examples/mod_example_hooks.c b/modules/examples/mod_example_hooks.c +index f7ef5a5..d937906 100644 +--- a/modules/examples/mod_example_hooks.c ++++ b/modules/examples/mod_example_hooks.c +@@ -993,7 +993,7 @@ static int x_handler(request_rec *r) + * Set the Content-type header. Note that we do not actually have to send + * the headers: this is done by the http core. + */ +- ap_set_content_type(r, "text/html"); ++ ap_set_content_type_ex(r, "text/html", 1); + /* + * If we're only supposed to send header information (HEAD request), we're + * already there. +diff --git a/modules/filters/mod_data.c b/modules/filters/mod_data.c +index ddadd1b..4e6e636 100644 +--- a/modules/filters/mod_data.c ++++ b/modules/filters/mod_data.c +@@ -117,7 +117,7 @@ static apr_status_t data_out_filter(ap_filter_t *f, apr_bucket_brigade *bb) + } + } + +- ap_set_content_type(r, "text/plain"); ++ ap_set_content_type_ex(r, "text/plain", 1); + + } + +diff --git a/modules/filters/mod_include.c b/modules/filters/mod_include.c +index 584d8fb..2c0cc67 100644 +--- a/modules/filters/mod_include.c ++++ b/modules/filters/mod_include.c +@@ -3972,7 +3972,7 @@ static int include_fixup(request_rec *r) + if (r->handler && (strcmp(r->handler, "server-parsed") == 0)) + { + if (!r->content_type || !*r->content_type) { +- ap_set_content_type(r, "text/html"); ++ ap_set_content_type_ex(r, "text/html", 1); + } + r->handler = "default-handler"; + } +diff --git a/modules/filters/mod_proxy_html.c b/modules/filters/mod_proxy_html.c +index 7783da1..4205a61 100644 +--- a/modules/filters/mod_proxy_html.c ++++ b/modules/filters/mod_proxy_html.c +@@ -952,7 +952,7 @@ static apr_status_t proxy_html_filter(ap_filter_t *f, apr_bucket_brigade *bb) + ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, f->r, APLOGNO(01422) + "No i18n support found. Install mod_xml2enc if required"); + enc = XML_CHAR_ENCODING_NONE; +- ap_set_content_type(f->r, "text/html;charset=utf-8"); ++ ap_set_content_type_ex(f->r, "text/html;charset=utf-8", 1); + } + else { + /* if we wanted a non-default charset_out, insert the +@@ -968,7 +968,7 @@ static apr_status_t proxy_html_filter(ap_filter_t *f, apr_bucket_brigade *bb) + cenc, NULL)); + } + else /* Normal case, everything worked, utf-8 output */ +- ap_set_content_type(f->r, "text/html;charset=utf-8"); ++ ap_set_content_type_ex(f->r, "text/html;charset=utf-8", 1); + } + + ap_fputs(f->next, ctxt->bb, ctxt->cfg->doctype); +diff --git a/modules/generators/mod_cgi.c b/modules/generators/mod_cgi.c +index 421124a..7d6cba9 100644 +--- a/modules/generators/mod_cgi.c ++++ b/modules/generators/mod_cgi.c +@@ -672,7 +672,7 @@ static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f, + /* Force sub_req to be treated as a CGI request, even if ordinary + * typing rules would have called it something else. + */ +- ap_set_content_type(rr, CGI_MAGIC_TYPE); ++ ap_set_content_type_ex(rr, CGI_MAGIC_TYPE, 1); + + /* Run it. */ + rr_status = ap_run_sub_req(rr); +diff --git a/modules/generators/mod_cgid.c b/modules/generators/mod_cgid.c +index dddfb25..3690957 100644 +--- a/modules/generators/mod_cgid.c ++++ b/modules/generators/mod_cgid.c +@@ -1667,7 +1667,7 @@ static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f, + /* Force sub_req to be treated as a CGI request, even if ordinary + * typing rules would have called it something else. + */ +- ap_set_content_type(rr, CGI_MAGIC_TYPE); ++ ap_set_content_type_ex(rr, CGI_MAGIC_TYPE, 1); + + /* Run it. */ + rr_status = ap_run_sub_req(rr); +diff --git a/modules/generators/mod_info.c b/modules/generators/mod_info.c +index b044273..3f3933d 100644 +--- a/modules/generators/mod_info.c ++++ b/modules/generators/mod_info.c +@@ -778,7 +778,7 @@ static int display_info(request_rec * r) + return DECLINED; + } + +- ap_set_content_type(r, "text/html; charset=ISO-8859-1"); ++ ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1); + + ap_rputs(DOCTYPE_XHTML_1_0T + "\n" +diff --git a/modules/generators/mod_status.c b/modules/generators/mod_status.c +index 5917953..b1d82cb 100644 +--- a/modules/generators/mod_status.c ++++ b/modules/generators/mod_status.c +@@ -269,7 +269,7 @@ static int status_handler(request_rec *r) + if (r->method_number != M_GET) + return DECLINED; + +- ap_set_content_type(r, "text/html; charset=ISO-8859-1"); ++ ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1); + + /* + * Simple table-driven form data set parser that lets you alter the header +@@ -297,7 +297,7 @@ static int status_handler(request_rec *r) + no_table_report = 1; + break; + case STAT_OPT_AUTO: +- ap_set_content_type(r, "text/plain; charset=ISO-8859-1"); ++ ap_set_content_type_ex(r, "text/plain; charset=ISO-8859-1", 1); + short_report = 1; + break; + } +diff --git a/modules/http/http_filters.c b/modules/http/http_filters.c +index 2e8fca6..1838179 100644 +--- a/modules/http/http_filters.c ++++ b/modules/http/http_filters.c +@@ -1258,7 +1258,7 @@ AP_DECLARE_NONSTD(int) ap_send_http_trace(request_rec *r) + } + } + +- ap_set_content_type(r, "message/http"); ++ ap_set_content_type_ex(r, "message/http", 1); + + /* Now we recreate the request, and echo it back */ + +diff --git a/modules/http/http_protocol.c b/modules/http/http_protocol.c +index c31e873..3bc666e 100644 +--- a/modules/http/http_protocol.c ++++ b/modules/http/http_protocol.c +@@ -1443,10 +1443,10 @@ AP_DECLARE(void) ap_send_error_response(request_rec *r, int recursive_error) + request_conf->suppress_charset = 1; /* avoid adding default + * charset later + */ +- ap_set_content_type(r, "text/html"); ++ ap_set_content_type_ex(r, "text/html", 1); + } + else { +- ap_set_content_type(r, "text/html; charset=iso-8859-1"); ++ ap_set_content_type_ex(r, "text/html; charset=iso-8859-1", 1); + } + + if ((status == HTTP_METHOD_NOT_ALLOWED) +diff --git a/modules/http/http_request.c b/modules/http/http_request.c +index d59cfe2..71ecc2b 100644 +--- a/modules/http/http_request.c ++++ b/modules/http/http_request.c +@@ -708,7 +708,7 @@ AP_DECLARE(void) ap_internal_fast_redirect(request_rec *rr, request_rec *r) + r->args = rr->args; + r->finfo = rr->finfo; + r->handler = rr->handler; +- ap_set_content_type(r, rr->content_type); ++ ap_set_content_type_ex(r, rr->content_type, AP_REQUEST_IS_TRUSTED_CT(r)); + r->content_encoding = rr->content_encoding; + r->content_languages = rr->content_languages; + r->per_dir_config = rr->per_dir_config; +diff --git a/modules/ldap/util_ldap.c b/modules/ldap/util_ldap.c +index 14b774a..c1072ff 100644 +--- a/modules/ldap/util_ldap.c ++++ b/modules/ldap/util_ldap.c +@@ -139,7 +139,7 @@ static int util_ldap_handler(request_rec *r) + st = (util_ldap_state_t *) ap_get_module_config(r->server->module_config, + &ldap_module); + +- ap_set_content_type(r, "text/html; charset=ISO-8859-1"); ++ ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1); + + if (r->header_only) + return OK; +diff --git a/modules/mappers/mod_imagemap.c b/modules/mappers/mod_imagemap.c +index 206c0b6..b2dca7e 100644 +--- a/modules/mappers/mod_imagemap.c ++++ b/modules/mappers/mod_imagemap.c +@@ -475,7 +475,7 @@ static int imap_reply(request_rec *r, const char *redirect) + + static void menu_header(request_rec *r, char *menu) + { +- ap_set_content_type(r, "text/html; charset=ISO-8859-1"); ++ ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1); + + ap_rvputs(r, DOCTYPE_HTML_3_2, "\nMenu for ", + ap_escape_html(r->pool, r->uri), +diff --git a/modules/proxy/mod_proxy_balancer.c b/modules/proxy/mod_proxy_balancer.c +index d175fcf..9ebe4da 100644 +--- a/modules/proxy/mod_proxy_balancer.c ++++ b/modules/proxy/mod_proxy_balancer.c +@@ -1470,7 +1470,7 @@ static void balancer_display_page(request_rec *r, proxy_server_conf *conf, + + if (usexml) { + char date[APR_RFC822_DATE_LEN]; +- ap_set_content_type(r, "text/xml"); ++ ap_set_content_type_ex(r, "text/xml", 1); + ap_rputs("<?xml version='1.0' encoding='UTF-8' ?>\n", r); + ap_rputs("<httpd:manager xmlns:httpd='http://httpd.apache.org'>\n", r); + ap_rputs(" <httpd:balancers>\n", r); +-- +2.33.0 + diff --git a/httpd.spec b/httpd.spec index 5bd6626..0149655 100644 --- a/httpd.spec +++ b/httpd.spec @@ -8,7 +8,7 @@ Name: httpd Summary: Apache HTTP Server Version: 2.4.51 -Release: 21 +Release: 22 License: ASL 2.0 URL: https://httpd.apache.org/ Source0: https://archive.apache.org/dist/httpd/httpd-%{version}.tar.bz2 @@ -117,6 +117,15 @@ Patch63: backport-Use-ap_os_is_path_absolute-to-make-it-portable.patch Patch64: backport-CVE-2024-24795-let-httpd-handle-CL-TE-for-non-http-handlers.patch Patch65: backport-CVE-2023-38709-header-validation-after-content.patch Patch66: backport-CVE-2024-27316-bail-after-too-many-failed-reads.patch +Patch67: backport-CVE-2024-38473-mod_proxy-escape-for-non-proxypass-configuration.patch +Patch68: backport-CVE-2024-38473-mod_proxy-Fixup-UDS-filename.patch +Patch69: backport-CVE-2024-38473-CVE-2024-39573-block-inadvertent-subst-of-special-filename.patch +Patch70: backport-CVE-2024-38473-fix-comparsion-of-local-path.patch +Patch71: backport-CVE-2024-38473-fix-the-filename-redirected.patch +Patch72: backport-CVE-2024-38474-CVE-2024-38475-tighten-up-prefix_stat.patch +Patch73: backport-CVE-2024-38476-add-ap_set_content_type_ex-to-differentiate-trusted-sources.patch +Patch74: backport-CVE-2024-38477-validate-hostsname.patch +Patch75: backport-CVE-2024-39884-maintain-trusted-flag.patch BuildRequires: gcc autoconf pkgconfig findutils xmlto perl-interpreter perl-generators systemd-devel BuildRequires: zlib-devel libselinux-devel lua-devel brotli-devel @@ -553,7 +562,13 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog -* Tue May 07 2024 chengyechun <chengyechun1@huaiwe.com> - 2.4.51-21 +* Sat Jul 06 2024 chengyechun <chengyechun1@huawei.com> - 2.4.51-22 +- Type:CVE +- ID:CVE-2024-38473,CVE-2024-38474,CVE-2024-38475,CVE-2024-38476,CVE-2024-38477,CVE-2024-39884,CVE-2024-39573 +- SUG:NA +- DSEC:fix some CVEs + +* Tue May 07 2024 chengyechun <chengyechun1@huawei.com> - 2.4.51-21 - Type:CVE - ID:CVE-2024-24795,CVE-2023-38709,CVE-2024-27316 - SUG:NA -- Gitee