From e02039f6993607f97d701da10da5ebb2922ee772 Mon Sep 17 00:00:00 2001 From: chengyechun Date: Fri, 3 Nov 2023 11:06:21 +0800 Subject: [PATCH] fix CVE-2023-31122 (cherry picked from commit 5e3ff35b4505aca9534c0ae8c64087eb3a67811c) --- ...ort-CVE-2023-31122-out-of-bound-Read.patch | 28 +++++++++++++++++++ httpd.spec | 9 +++++- 2 files changed, 36 insertions(+), 1 deletion(-) create mode 100644 backport-CVE-2023-31122-out-of-bound-Read.patch diff --git a/backport-CVE-2023-31122-out-of-bound-Read.patch b/backport-CVE-2023-31122-out-of-bound-Read.patch new file mode 100644 index 0000000..aebeaeb --- /dev/null +++ b/backport-CVE-2023-31122-out-of-bound-Read.patch @@ -0,0 +1,28 @@ +From c41eb3b14a3d1eb2e3c42c4728cc52a22748851a Mon Sep 17 00:00:00 2001 +From: Stefan Eissing +Date: Mon, 16 Oct 2023 06:39:44 +0000 +Subject: [PATCH] mod_macro: out of bounds Read + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/c41eb3b14a3d1eb2e3c42c4728cc52a22748851a + +--- + modules/core/mod_macro.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/modules/core/mod_macro.c b/modules/core/mod_macro.c +index 04af43b..cc42d0b 100644 +--- a/modules/core/mod_macro.c ++++ b/modules/core/mod_macro.c +@@ -465,7 +465,7 @@ static const char *process_content(apr_pool_t * pool, + for (i = 0; i < contents->nelts; i++) { + const char *errmsg; + /* copy the line and substitute macro parameters */ +- strncpy(line, ((char **) contents->elts)[i], MAX_STRING_LEN - 1); ++ apr_cpystrn(line, ((char **) contents->elts)[i], MAX_STRING_LEN); + errmsg = substitute_macro_args(line, MAX_STRING_LEN, + macro, replacements, used); + if (errmsg) { +-- +2.23.0 + diff --git a/httpd.spec b/httpd.spec index f10eb5d..312b5ec 100644 --- a/httpd.spec +++ b/httpd.spec @@ -8,7 +8,7 @@ Name: httpd Summary: Apache HTTP Server Version: 2.4.51 -Release: 18 +Release: 19 License: ASL 2.0 URL: https://httpd.apache.org/ Source0: https://archive.apache.org/dist/httpd/httpd-%{version}.tar.bz2 @@ -108,6 +108,7 @@ Patch54: backport-Fix-double-encoding-of-the-uri-path-of-the-request.pa Patch55: backport-do-not-match-the-extention-against-possible-query-string.patch Patch56: backport-Do-not-double-encode-encoded-slashes.patch Patch57: backport-Check-before-forwarding-that-a-nocanon-path-has-not-been-rewritten.patch +Patch58: backport-CVE-2023-31122-out-of-bound-Read.patch BuildRequires: gcc autoconf pkgconfig findutils xmlto perl-interpreter perl-generators systemd-devel BuildRequires: zlib-devel libselinux-devel lua-devel brotli-devel @@ -544,6 +545,12 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Fri Nov 03 2023 chengyechun - 2.4.51-19 +- Type:CVE +- ID:CVE-2023-31122 +- SUG:NA +- DESC:fix CVE-2023-31122 + * Wed Aug 09 2023 panchenbo - 2.4.51-18 - Type:bugfix - ID: -- Gitee