diff --git a/backport-CVE-2023-38709-header-validation-after-content.patch b/backport-CVE-2023-38709-header-validation-after-content.patch new file mode 100644 index 0000000000000000000000000000000000000000..e26c9553ba370b92b3b793007792d8b1cdaa7387 --- /dev/null +++ b/backport-CVE-2023-38709-header-validation-after-content.patch @@ -0,0 +1,97 @@ +From ac20389f3c816d990aba21720f1492b69ac5cb44 Mon Sep 17 00:00:00 2001 +From: Eric Covener +Date: Wed, 3 Apr 2024 12:12:23 +0000 +Subject: [PATCH] header validation after content-* are eval'ed + +backport r1916770 from trunk +Submitted By: ylavic + + + + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1916778 13f79535-47bb-0310-9956-ffa450edef68 + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/ac20389f3c816d990aba21720f1492b69ac5cb44 + +--- + modules/http/http_filters.c | 28 ++++++++++++++++------------ + 1 file changed, 16 insertions(+), 12 deletions(-) + +diff --git a/modules/http/http_filters.c b/modules/http/http_filters.c +index 3ad74dd..2e8fca6 100644 +--- a/modules/http/http_filters.c ++++ b/modules/http/http_filters.c +@@ -1362,6 +1362,9 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f, + */ + apr_table_clear(r->headers_out); + apr_table_clear(r->err_headers_out); ++ r->content_type = r->content_encoding = NULL; ++ r->content_languages = NULL; ++ r->clength = r->chunked = 0; + apr_brigade_cleanup(b); + + /* Don't recall ap_die() if we come back here (from its own internal +@@ -1378,8 +1381,6 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f, + APR_BRIGADE_INSERT_TAIL(b, e); + e = apr_bucket_eos_create(c->bucket_alloc); + APR_BRIGADE_INSERT_TAIL(b, e); +- r->content_type = r->content_encoding = NULL; +- r->content_languages = NULL; + ap_set_content_length(r, 0); + recursive_error = 1; + } +@@ -1406,6 +1407,7 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f, + if (!apr_is_empty_table(r->err_headers_out)) { + r->headers_out = apr_table_overlay(r->pool, r->err_headers_out, + r->headers_out); ++ apr_table_clear(r->err_headers_out); + } + + /* +@@ -1425,6 +1427,17 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f, + fixup_vary(r); + } + ++ ++ /* ++ * Control cachability for non-cacheable responses if not already set by ++ * some other part of the server configuration. ++ */ ++ if (r->no_cache && !apr_table_get(r->headers_out, "Expires")) { ++ char *date = apr_palloc(r->pool, APR_RFC822_DATE_LEN); ++ ap_recent_rfc822_date(date, r->request_time); ++ apr_table_addn(r->headers_out, "Expires", date); ++ } ++ + /* + * Now remove any ETag response header field if earlier processing + * says so (such as a 'FileETag None' directive). +@@ -1437,6 +1450,7 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f, + basic_http_header_check(r, &protocol); + ap_set_keepalive(r); + ++ /* 204/304 responses don't have content related headers */ + if (AP_STATUS_IS_HEADER_ONLY(r->status)) { + apr_table_unset(r->headers_out, "Transfer-Encoding"); + apr_table_unset(r->headers_out, "Content-Length"); +@@ -1479,16 +1493,6 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f, + apr_table_setn(r->headers_out, "Content-Language", field); + } + +- /* +- * Control cachability for non-cacheable responses if not already set by +- * some other part of the server configuration. +- */ +- if (r->no_cache && !apr_table_get(r->headers_out, "Expires")) { +- char *date = apr_palloc(r->pool, APR_RFC822_DATE_LEN); +- ap_recent_rfc822_date(date, r->request_time); +- apr_table_addn(r->headers_out, "Expires", date); +- } +- + /* This is a hack, but I can't find anyway around it. The idea is that + * we don't want to send out 0 Content-Lengths if it is a head request. + * This happens when modules try to outsmart the server, and return +-- +2.33.0 + diff --git a/backport-CVE-2024-24795-let-httpd-handle-CL-TE-for-non-http-handlers.patch b/backport-CVE-2024-24795-let-httpd-handle-CL-TE-for-non-http-handlers.patch new file mode 100644 index 0000000000000000000000000000000000000000..ff7c0634ad4d12b4b2f295d37348a3f88c8677b5 --- /dev/null +++ b/backport-CVE-2024-24795-let-httpd-handle-CL-TE-for-non-http-handlers.patch @@ -0,0 +1,201 @@ +From 61645eaac828e2603203d2dfafca938f22580655 Mon Sep 17 00:00:00 2001 +From: Eric Covener +Date: Wed, 3 Apr 2024 11:49:53 +0000 +Subject: [PATCH] let httpd handle CL/TE for non-http handlers + +Submitted By: ylavic, covener + + + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1916769 13f79535-47bb-0310-9956-ffa450edef68 + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/61645eaac828e2603203d2dfafca938f22580655 + +--- + include/util_script.h | 2 ++ + modules/aaa/mod_authnz_fcgi.c | 8 ++++++++ + modules/generators/cgi_common.h | 16 +++++++++++++--- + modules/http/http_filters.c | 12 ++++++++++++ + modules/proxy/ajp_header.c | 10 ++++++++++ + modules/proxy/mod_proxy_fcgi.c | 9 +++++++++ + modules/proxy/mod_proxy_scgi.c | 8 ++++++++ + modules/proxy/mod_proxy_uwsgi.c | 6 ++++++ + 8 files changed, 68 insertions(+), 3 deletions(-) + +diff --git a/include/util_script.h b/include/util_script.h +index 3566bd3..0557c7f 100644 +--- a/include/util_script.h ++++ b/include/util_script.h +@@ -225,6 +225,8 @@ AP_DECLARE(int) ap_scan_script_header_err_core_ex(request_rec *r, char *buffer, + */ + AP_DECLARE(void) ap_args_to_table(request_rec *r, apr_table_t **table); + ++#define AP_TRUST_CGILIKE_CL_ENVVAR "ap_trust_cgilike_cl" ++ + #ifdef __cplusplus + } + #endif +diff --git a/modules/aaa/mod_authnz_fcgi.c b/modules/aaa/mod_authnz_fcgi.c +index 1aadcc2..69743f1 100644 +--- a/modules/aaa/mod_authnz_fcgi.c ++++ b/modules/aaa/mod_authnz_fcgi.c +@@ -571,6 +571,14 @@ static apr_status_t handle_response(const fcgi_provider_conf *conf, + "parsing -> %d/%d", + fn, status, r->status); + ++ /* FCGI has its own body framing mechanism which we don't ++ * match against any provided Content-Length, so let the ++ * core determine C-L vs T-E based on what's actually sent. ++ */ ++ if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR)) ++ apr_table_unset(r->headers_out, "Content-Length"); ++ apr_table_unset(r->headers_out, "Transfer-Encoding"); ++ + if (rspbuf) { /* caller wants to see response body, + * if any + */ +diff --git a/modules/generators/cgi_common.h b/modules/generators/cgi_common.h +index 69df73c..66f9418 100644 +--- a/modules/generators/cgi_common.h ++++ b/modules/generators/cgi_common.h +@@ -26,6 +26,7 @@ + + #include "httpd.h" + #include "util_filter.h" ++#include "util_script.h" + + static APR_OPTIONAL_FN_TYPE(ap_ssi_get_tag_and_value) *cgi_pfn_gtv; + static APR_OPTIONAL_FN_TYPE(ap_ssi_parse_string) *cgi_pfn_ps; +@@ -428,9 +429,18 @@ static int cgi_handle_response(request_rec *r, int nph, apr_bucket_brigade *bb, + char sbuf[MAX_STRING_LEN]; + int ret; + +- if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf, +- APLOG_MODULE_INDEX))) +- { ++ ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf, ++ APLOG_MODULE_INDEX); ++ ++ /* xCGI has its own body framing mechanism which we don't ++ * match against any provided Content-Length, so let the ++ * core determine C-L vs T-E based on what's actually sent. ++ */ ++ if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR)) ++ apr_table_unset(r->headers_out, "Content-Length"); ++ apr_table_unset(r->headers_out, "Transfer-Encoding"); ++ ++ if (ret != OK) { + /* In the case of a timeout reading script output, clear + * the brigade to avoid a second attempt to read the + * output. */ +diff --git a/modules/http/http_filters.c b/modules/http/http_filters.c +index c3eab95..3ad74dd 100644 +--- a/modules/http/http_filters.c ++++ b/modules/http/http_filters.c +@@ -775,6 +775,18 @@ static APR_INLINE int check_headers(request_rec *r) + struct check_header_ctx ctx; + core_server_config *conf = + ap_get_core_module_config(r->server->module_config); ++ const char *val; ++ ++ if ((val = apr_table_get(r->headers_out, "Transfer-Encoding"))) { ++ if (apr_table_get(r->headers_out, "Content-Length")) { ++ apr_table_unset(r->headers_out, "Content-Length"); ++ r->connection->keepalive = AP_CONN_CLOSE; ++ } ++ if (!ap_is_chunked(r->pool, val)) { ++ r->connection->keepalive = AP_CONN_CLOSE; ++ return 0; ++ } ++ } + + ctx.r = r; + ctx.strict = (conf->http_conformance != AP_HTTP_CONFORMANCE_UNSAFE); +diff --git a/modules/proxy/ajp_header.c b/modules/proxy/ajp_header.c +index a09a2e4..0266a7d 100644 +--- a/modules/proxy/ajp_header.c ++++ b/modules/proxy/ajp_header.c +@@ -17,6 +17,8 @@ + #include "ajp_header.h" + #include "ajp.h" + ++#include "util_script.h" ++ + APLOG_USE_MODULE(proxy_ajp); + + static const char *response_trans_headers[] = { +@@ -669,6 +671,14 @@ static apr_status_t ajp_unmarshal_response(ajp_msg_t *msg, + } + } + ++ /* AJP has its own body framing mechanism which we don't ++ * match against any provided Content-Length, so let the ++ * core determine C-L vs T-E based on what's actually sent. ++ */ ++ if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR)) ++ apr_table_unset(r->headers_out, "Content-Length"); ++ apr_table_unset(r->headers_out, "Transfer-Encoding"); ++ + return APR_SUCCESS; + } + +diff --git a/modules/proxy/mod_proxy_fcgi.c b/modules/proxy/mod_proxy_fcgi.c +index 831bd15..d420df6 100644 +--- a/modules/proxy/mod_proxy_fcgi.c ++++ b/modules/proxy/mod_proxy_fcgi.c +@@ -779,6 +779,15 @@ recv_again: + + status = ap_scan_script_header_err_brigade_ex(r, ob, + NULL, APLOG_MODULE_INDEX); ++ ++ /* FCGI has its own body framing mechanism which we don't ++ * match against any provided Content-Length, so let the ++ * core determine C-L vs T-E based on what's actually sent. ++ */ ++ if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR)) ++ apr_table_unset(r->headers_out, "Content-Length"); ++ apr_table_unset(r->headers_out, "Transfer-Encoding"); ++ + /* suck in all the rest */ + if (status != OK) { + apr_bucket *tmp_b; +diff --git a/modules/proxy/mod_proxy_scgi.c b/modules/proxy/mod_proxy_scgi.c +index 5444a5c..d63c833 100644 +--- a/modules/proxy/mod_proxy_scgi.c ++++ b/modules/proxy/mod_proxy_scgi.c +@@ -390,6 +390,14 @@ static int pass_response(request_rec *r, proxy_conn_rec *conn) + return status; + } + ++ /* SCGI has its own body framing mechanism which we don't ++ * match against any provided Content-Length, so let the ++ * core determine C-L vs T-E based on what's actually sent. ++ */ ++ if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR)) ++ apr_table_unset(r->headers_out, "Content-Length"); ++ apr_table_unset(r->headers_out, "Transfer-Encoding"); ++ + conf = ap_get_module_config(r->per_dir_config, &proxy_scgi_module); + if (conf->sendfile && conf->sendfile != scgi_sendfile_off) { + short err = 1; +diff --git a/modules/proxy/mod_proxy_uwsgi.c b/modules/proxy/mod_proxy_uwsgi.c +index f0cbb5d..0ccf2ab 100644 +--- a/modules/proxy/mod_proxy_uwsgi.c ++++ b/modules/proxy/mod_proxy_uwsgi.c +@@ -404,6 +404,12 @@ static int uwsgi_response(request_rec *r, proxy_conn_rec * backend, + return HTTP_BAD_GATEWAY; + } + ++ /* T-E wins over C-L */ ++ if (apr_table_get(r->headers_out, "Transfer-Encoding")) { ++ apr_table_unset(r->headers_out, "Content-Length"); ++ backend->close = 1; ++ } ++ + if ((buf = apr_table_get(r->headers_out, "Content-Type"))) { + ap_set_content_type(r, apr_pstrdup(r->pool, buf)); + } +-- +2.33.0 + diff --git a/backport-CVE-2024-27316-bail-after-too-many-failed-reads.patch b/backport-CVE-2024-27316-bail-after-too-many-failed-reads.patch new file mode 100644 index 0000000000000000000000000000000000000000..837d656a6b9f3c0fbaf1755011bd54aa688923c4 --- /dev/null +++ b/backport-CVE-2024-27316-bail-after-too-many-failed-reads.patch @@ -0,0 +1,73 @@ +From 0d73970ec161300a55b630f71bbf72b5c41f28b9 Mon Sep 17 00:00:00 2001 +From: Eric Covener +Date: Wed, 3 Apr 2024 12:12:55 +0000 +Subject: [PATCH] Merge r1916771 from trunk: + +bail after too many failed reads + +Submitted By: icing + + + + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1916779 13f79535-47bb-0310-9956-ffa450edef68 + +Conflict:The mod_http2 version upgrade (9767274) and new feature (06ceb22) are not integrated. As a result, context adaptation exists in h2_stream.h. +Reference:https://github.com/apache/httpd/commit/0d73970ec161300a55b630f71bbf72b5c41f28b9 + +--- + modules/http2/h2_session.c | 10 +++++++--- + modules/http2/h2_stream.c | 1 + + modules/http2/h2_stream.h | 3 ++- + 3 files changed, 10 insertions(+), 4 deletions(-) + +diff --git a/modules/http2/h2_session.c b/modules/http2/h2_session.c +index afd9edb..308bc4a 100644 +--- a/modules/http2/h2_session.c ++++ b/modules/http2/h2_session.c +@@ -311,9 +311,13 @@ static int on_header_cb(nghttp2_session *ngh2, const nghttp2_frame *frame, + + status = h2_stream_add_header(stream, (const char *)name, namelen, + (const char *)value, valuelen); +- if (status != APR_SUCCESS +- && (!stream->rtmp +- || stream->rtmp->http_status == H2_HTTP_STATUS_UNSET)) { ++ if (status != APR_SUCCESS && ++ (!stream->rtmp || ++ stream->rtmp->http_status == H2_HTTP_STATUS_UNSET || ++ /* We accept a certain amount of failures in order to reply ++ * with an informative HTTP error response like 413. But if the ++ * client is too wrong, we fail the request a RESET of the stream */ ++ stream->request_headers_failed > 100)) { + return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE; + } + return 0; +diff --git a/modules/http2/h2_stream.c b/modules/http2/h2_stream.c +index 49d89cb..bde8609 100644 +--- a/modules/http2/h2_stream.c ++++ b/modules/http2/h2_stream.c +@@ -764,6 +764,7 @@ apr_status_t h2_stream_add_header(h2_stream *stream, + + cleanup: + if (error) { ++ ++stream->request_headers_failed; + set_error_response(stream, error); + return APR_EINVAL; + } +diff --git a/modules/http2/h2_stream.h b/modules/http2/h2_stream.h +index 08f7888..1b89eaf 100644 +--- a/modules/http2/h2_stream.h ++++ b/modules/http2/h2_stream.h +@@ -75,7 +75,8 @@ struct h2_stream { + struct h2_request *rtmp; /* request being assembled */ + apr_table_t *trailers; /* optional incoming trailers */ + int request_headers_added; /* number of request headers added */ +- ++ int request_headers_failed; /* number of request headers failed to add */ ++ + struct h2_bucket_beam *input; + apr_bucket_brigade *in_buffer; + int in_window_size; +-- +2.33.0 + diff --git a/backport-Check-before-forwarding-that-a-nocanon-path-has-not-been-rewritten.patch b/backport-Check-before-forwarding-that-a-nocanon-path-has-not-been-rewritten.patch new file mode 100644 index 0000000000000000000000000000000000000000..78a1c936b1803bde7afebe90be3afe307bd73cd8 --- /dev/null +++ b/backport-Check-before-forwarding-that-a-nocanon-path-has-not-been-rewritten.patch @@ -0,0 +1,288 @@ +From fd92481223a0d213f1dc2f96745f495efcf33eca Mon Sep 17 00:00:00 2001 +From: Ruediger Pluem +Date: Fri, 31 Mar 2023 10:37:34 PM GMT+0800 +Subject: [PATCH] mod_proxy:Check before forwarding that a nocanon path has not been + rewritten with spaces during processing + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/fd92481223a0d213f1dc2f96745f495efcf33eca + +--- + modules/http2/mod_proxy_http2.c | 31 +++++++++++++++++------------ + modules/proxy/mod_proxy_ajp.c | 19 ++++++++++++------ + modules/proxy/mod_proxy_balancer.c | 19 ++++++++++++------ + modules/proxy/mod_proxy_fcgi.c | 15 ++++++++++++-- + modules/proxy/mod_proxy_http.c | 32 ++++++++++++++++++------------ + modules/proxy/mod_proxy_uwsgi.c | 14 +++++++++++-- + modules/proxy/mod_proxy_wstunnel.c | 19 ++++++++++++------ + 7 files changed, 101 insertions(+), 48 deletions(-) + +diff --git a/modules/http2/mod_proxy_http2.c b/modules/http2/mod_proxy_http2.c +index 77e2641..957c7ba 100644 +--- a/modules/http2/mod_proxy_http2.c ++++ b/modules/http2/mod_proxy_http2.c +@@ -164,26 +164,31 @@ static int proxy_http2_canon(request_rec *r, char *url) + + path = ap_proxy_canonenc_ex(r->pool, url, (int)strlen(url), + enc_path, flags, r->proxyreq); ++ if (!path) { ++ return HTTP_BAD_REQUEST; ++ } + search = r->args; + } +- if (search && *(ap_scan_vchar_obstext(search))) { +- /* +- * We have a raw control character or a ' ' in r->args. +- * Correct encoding was missed. +- */ +- ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10412) +- "To be forwarded query string contains control " +- "characters or spaces"); +- return HTTP_FORBIDDEN; +- } + break; + case PROXYREQ_PROXY: + path = url; + break; + } +- +- if (path == NULL) { +- return HTTP_BAD_REQUEST; ++ /* ++ * If we have a raw control character or a ' ' in nocanon path or ++ * r->args, correct encoding was missed. ++ */ ++ if (path == url && *ap_scan_vchar_obstext(path)) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10420) ++ "To be forwarded path contains control " ++ "characters or spaces"); ++ return HTTP_FORBIDDEN; ++ } ++ if (search && *ap_scan_vchar_obstext(search)) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10412) ++ "To be forwarded query string contains control " ++ "characters or spaces"); ++ return HTTP_FORBIDDEN; + } + + if (port != def_port) { +diff --git a/modules/proxy/mod_proxy_ajp.c b/modules/proxy/mod_proxy_ajp.c +index 747f928..4446c5e 100644 +--- a/modules/proxy/mod_proxy_ajp.c ++++ b/modules/proxy/mod_proxy_ajp.c +@@ -75,20 +75,27 @@ static int proxy_ajp_canon(request_rec *r, char *url) + + path = ap_proxy_canonenc_ex(r->pool, url, strlen(url), enc_path, flags, + r->proxyreq); ++ if (!path) { ++ return HTTP_BAD_REQUEST; ++ } + search = r->args; + } ++ /* ++ * If we have a raw control character or a ' ' in nocanon path or ++ * r->args, correct encoding was missed. ++ */ ++ if (path == url && *ap_scan_vchar_obstext(path)) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10418) ++ "To be forwarded path contains control " ++ "characters or spaces"); ++ return HTTP_FORBIDDEN; ++ } + if (search && *(ap_scan_vchar_obstext(search))) { +- /* +- * We have a raw control character or a ' ' in r->args. +- * Correct encoding was missed. +- */ + ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10406) + "To be forwarded query string contains control " + "characters or spaces"); + return HTTP_FORBIDDEN; + } +- if (path == NULL) +- return HTTP_BAD_REQUEST; + + if (port != def_port) + apr_snprintf(sport, sizeof(sport), ":%d", port); +diff --git a/modules/proxy/mod_proxy_balancer.c b/modules/proxy/mod_proxy_balancer.c +index de31749..d175fcf 100644 +--- a/modules/proxy/mod_proxy_balancer.c ++++ b/modules/proxy/mod_proxy_balancer.c +@@ -112,20 +112,27 @@ static int proxy_balancer_canon(request_rec *r, char *url) + + path = ap_proxy_canonenc_ex(r->pool, url, strlen(url), enc_path, flags, + r->proxyreq); ++ if (!path) { ++ return HTTP_BAD_REQUEST; ++ } + search = r->args; + } ++ /* ++ * If we have a raw control character or a ' ' in nocanon path or ++ * r->args, correct encoding was missed. ++ */ ++ if (path == url && *ap_scan_vchar_obstext(path)) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10416) ++ "To be forwarded path contains control " ++ "characters or spaces"); ++ return HTTP_FORBIDDEN; ++ } + if (search && *(ap_scan_vchar_obstext(search))) { +- /* +- * We have a raw control character or a ' ' in r->args. +- * Correct encoding was missed. +- */ + ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10407) + "To be forwarded query string contains control " + "characters or spaces"); + return HTTP_FORBIDDEN; + } +- if (path == NULL) +- return HTTP_BAD_REQUEST; + + r->filename = apr_pstrcat(r->pool, "proxy:" BALANCER_PREFIX, host, + "/", path, (search) ? "?" : "", (search) ? search : "", NULL); +diff --git a/modules/proxy/mod_proxy_fcgi.c b/modules/proxy/mod_proxy_fcgi.c +index a422b4e..831bd15 100644 +--- a/modules/proxy/mod_proxy_fcgi.c ++++ b/modules/proxy/mod_proxy_fcgi.c +@@ -102,9 +102,20 @@ static int proxy_fcgi_canon(request_rec *r, char *url) + + path = ap_proxy_canonenc_ex(r->pool, url, strlen(url), enc_path, flags, + r->proxyreq); ++ if (!path) { ++ return HTTP_BAD_REQUEST; ++ } ++ } ++ /* ++ * If we have a raw control character or a ' ' in nocanon path, ++ * correct encoding was missed. ++ */ ++ if (path == url && *ap_scan_vchar_obstext(path)) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10414) ++ "To be forwarded path contains control " ++ "characters or spaces"); ++ return HTTP_FORBIDDEN; + } +- if (path == NULL) +- return HTTP_BAD_REQUEST; + + r->filename = apr_pstrcat(r->pool, "proxy:fcgi://", host, sport, "/", + path, NULL); +diff --git a/modules/proxy/mod_proxy_http.c b/modules/proxy/mod_proxy_http.c +index fca8d5d..40f0787 100644 +--- a/modules/proxy/mod_proxy_http.c ++++ b/modules/proxy/mod_proxy_http.c +@@ -131,26 +131,32 @@ static int proxy_http_canon(request_rec *r, char *url) + + path = ap_proxy_canonenc_ex(r->pool, url, strlen(url), enc_path, + flags, r->proxyreq); ++ if (!path) { ++ return HTTP_BAD_REQUEST; ++ } + search = r->args; + } +- if (search && *(ap_scan_vchar_obstext(search))) { +- /* +- * We have a raw control character or a ' ' in r->args. +- * Correct encoding was missed. +- */ +- ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10408) +- "To be forwarded query string contains control " +- "characters or spaces"); +- return HTTP_FORBIDDEN; +- } + break; + case PROXYREQ_PROXY: + path = url; + break; + } +- +- if (path == NULL) +- return HTTP_BAD_REQUEST; ++ /* ++ * If we have a raw control character or a ' ' in nocanon path or ++ * r->args, correct encoding was missed. ++ */ ++ if (path == url && *ap_scan_vchar_obstext(path)) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10415) ++ "To be forwarded path contains control " ++ "characters or spaces"); ++ return HTTP_FORBIDDEN; ++ } ++ if (search && *ap_scan_vchar_obstext(search)) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10408) ++ "To be forwarded query string contains control " ++ "characters or spaces"); ++ return HTTP_FORBIDDEN; ++ } + + if (port != def_port) + apr_snprintf(sport, sizeof(sport), ":%d", port); +diff --git a/modules/proxy/mod_proxy_uwsgi.c b/modules/proxy/mod_proxy_uwsgi.c +index 771fcea..f0cbb5d 100644 +--- a/modules/proxy/mod_proxy_uwsgi.c ++++ b/modules/proxy/mod_proxy_uwsgi.c +@@ -94,9 +94,19 @@ static int uwsgi_canon(request_rec *r, char *url) + + path = ap_proxy_canonenc_ex(r->pool, url, strlen(url), enc_path, flags, + r->proxyreq); ++ if (!path) { ++ return HTTP_BAD_REQUEST; ++ } + } +- if (!path) { +- return HTTP_BAD_REQUEST; ++ /* ++ * If we have a raw control character or a ' ' in nocanon path, ++ * correct encoding was missed. ++ */ ++ if (path == url && *ap_scan_vchar_obstext(path)) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10417) ++ "To be forwarded path contains control " ++ "characters or spaces"); ++ return HTTP_FORBIDDEN; + } + + r->filename = +diff --git a/modules/proxy/mod_proxy_wstunnel.c b/modules/proxy/mod_proxy_wstunnel.c +index a44bb44..227dba4 100644 +--- a/modules/proxy/mod_proxy_wstunnel.c ++++ b/modules/proxy/mod_proxy_wstunnel.c +@@ -120,20 +120,27 @@ static int proxy_wstunnel_canon(request_rec *r, char *url) + + path = ap_proxy_canonenc_ex(r->pool, url, strlen(url), enc_path, flags, + r->proxyreq); ++ if (!path) { ++ return HTTP_BAD_REQUEST; ++ } + search = r->args; + } ++ /* ++ * If we have a raw control character or a ' ' in nocanon path or ++ * r->args, correct encoding was missed. ++ */ ++ if (path == url && *ap_scan_vchar_obstext(path)) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10419) ++ "To be forwarded path contains control " ++ "characters or spaces"); ++ return HTTP_FORBIDDEN; ++ } + if (search && *(ap_scan_vchar_obstext(search))) { +- /* +- * We have a raw control character or a ' ' in r->args. +- * Correct encoding was missed. +- */ + ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10409) + "To be forwarded query string contains control " + "characters or spaces"); + return HTTP_FORBIDDEN; + } +- if (path == NULL) +- return HTTP_BAD_REQUEST; + + if (port != def_port) + apr_snprintf(sport, sizeof(sport), ":%d", port); +-- +2.27.0 + diff --git a/backport-Do-not-double-encode-encoded-slashes.patch b/backport-Do-not-double-encode-encoded-slashes.patch new file mode 100644 index 0000000000000000000000000000000000000000..203c57973d83f14360a9b89a41448bee653ba80f --- /dev/null +++ b/backport-Do-not-double-encode-encoded-slashes.patch @@ -0,0 +1,322 @@ +From 9b8cf1746bb004050b02a30bf0222479fbe405c2 Mon Sep 17 00:00:00 2001 +From: Ruediger Pluem +Date: Fri, 31 Mar 2023 10:33:47 PM GMT+0800 +Subject: [PATCH] mod_proxy:In case that AllowEncodedSlashes is set to NoDecode do not + double encode encoded slashes in the URL sent by the reverse proxy to the + backend + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/9b8cf1746bb004050b02a30bf0222479fbe405c2 + +--- + include/ap_mmn.h | 3 ++- + modules/http2/mod_proxy_http2.c | 7 ++++-- + modules/proxy/mod_proxy.h | 6 +++++ + modules/proxy/mod_proxy_ajp.c | 7 ++++-- + modules/proxy/mod_proxy_balancer.c | 7 ++++-- + modules/proxy/mod_proxy_fcgi.c | 7 ++++-- + modules/proxy/mod_proxy_ftp.c | 5 +++- + modules/proxy/mod_proxy_http.c | 7 ++++-- + modules/proxy/mod_proxy_scgi.c | 6 +++-- + modules/proxy/mod_proxy_uwsgi.c | 7 ++++-- + modules/proxy/mod_proxy_wstunnel.c | 7 ++++-- + modules/proxy/proxy_util.c | 39 ++++++++++++++++++++++++++---- + 12 files changed, 85 insertions(+), 23 deletions(-) + +diff --git a/include/ap_mmn.h b/include/ap_mmn.h +index a6d47a2..dd469f3 100644 +--- a/include/ap_mmn.h ++++ b/include/ap_mmn.h +@@ -582,6 +582,7 @@ + * 20120211.118 (2.4.51-dev) Add ap_unescape_url_ex() and deprecate + * AP_NORMALIZE_DROP_PARAMETERS + * 20120211.121 (2.4.51-dev) Add ap_post_read_request() ++ * 20120211.122 (2.4.51-dev) Add ap_proxy_canonenc_ex + * + */ + +@@ -590,7 +591,7 @@ + #ifndef MODULE_MAGIC_NUMBER_MAJOR + #define MODULE_MAGIC_NUMBER_MAJOR 20120211 + #endif +-#define MODULE_MAGIC_NUMBER_MINOR 118 /* 0...n */ ++#define MODULE_MAGIC_NUMBER_MINOR 122 /* 0...n */ + + /** + * Determine if the server's current MODULE_MAGIC_NUMBER is at least a +diff --git a/modules/http2/mod_proxy_http2.c b/modules/http2/mod_proxy_http2.c +index 9b741e1..77e2641 100644 +--- a/modules/http2/mod_proxy_http2.c ++++ b/modules/http2/mod_proxy_http2.c +@@ -159,8 +159,11 @@ static int proxy_http2_canon(request_rec *r, char *url) + search = r->args; + } + else { +- path = ap_proxy_canonenc(r->pool, url, (int)strlen(url), +- enc_path, 0, r->proxyreq); ++ core_dir_config *d = ap_get_core_module_config(r->per_dir_config); ++ int flags = d->allow_encoded_slashes && !d->decode_encoded_slashes ? PROXY_CANONENC_NOENCODEDSLASHENCODING : 0; ++ ++ path = ap_proxy_canonenc_ex(r->pool, url, (int)strlen(url), ++ enc_path, flags, r->proxyreq); + search = r->args; + } + if (search && *(ap_scan_vchar_obstext(search))) { +diff --git a/modules/proxy/mod_proxy.h b/modules/proxy/mod_proxy.h +index 47899d7..ce8183a 100644 +--- a/modules/proxy/mod_proxy.h ++++ b/modules/proxy/mod_proxy.h +@@ -76,6 +76,10 @@ enum enctype { + enc_path, enc_search, enc_user, enc_fpath, enc_parm + }; + ++/* Flags for ap_proxy_canonenc_ex */ ++#define PROXY_CANONENC_FORCEDEC 0x01 ++#define PROXY_CANONENC_NOENCODEDSLASHENCODING 0x02 ++ + typedef enum { + NONE, TCP, OPTIONS, HEAD, GET, CPING, PROVIDER, EOT + } hcmethod_t; +@@ -669,6 +673,8 @@ PROXY_DECLARE(apr_status_t) ap_proxy_strncpy(char *dst, const char *src, + apr_size_t dlen); + PROXY_DECLARE(int) ap_proxy_hex2c(const char *x); + PROXY_DECLARE(void) ap_proxy_c2hex(int ch, char *x); ++PROXY_DECLARE(char *)ap_proxy_canonenc_ex(apr_pool_t *p, const char *x, int len, enum enctype t, ++ int flags, int proxyreq); + PROXY_DECLARE(char *)ap_proxy_canonenc(apr_pool_t *p, const char *x, int len, enum enctype t, + int forcedec, int proxyreq); + PROXY_DECLARE(char *)ap_proxy_canon_netloc(apr_pool_t *p, char **const urlp, char **userp, +diff --git a/modules/proxy/mod_proxy_ajp.c b/modules/proxy/mod_proxy_ajp.c +index 731e4ed..747f928 100644 +--- a/modules/proxy/mod_proxy_ajp.c ++++ b/modules/proxy/mod_proxy_ajp.c +@@ -70,8 +70,11 @@ static int proxy_ajp_canon(request_rec *r, char *url) + search = r->args; + } + else { +- path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0, +- r->proxyreq); ++ core_dir_config *d = ap_get_core_module_config(r->per_dir_config); ++ int flags = d->allow_encoded_slashes && !d->decode_encoded_slashes ? PROXY_CANONENC_NOENCODEDSLASHENCODING : 0; ++ ++ path = ap_proxy_canonenc_ex(r->pool, url, strlen(url), enc_path, flags, ++ r->proxyreq); + search = r->args; + } + if (search && *(ap_scan_vchar_obstext(search))) { +diff --git a/modules/proxy/mod_proxy_balancer.c b/modules/proxy/mod_proxy_balancer.c +index 719a99e..de31749 100644 +--- a/modules/proxy/mod_proxy_balancer.c ++++ b/modules/proxy/mod_proxy_balancer.c +@@ -107,8 +107,11 @@ static int proxy_balancer_canon(request_rec *r, char *url) + search = r->args; + } + else { +- path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0, +- r->proxyreq); ++ core_dir_config *d = ap_get_core_module_config(r->per_dir_config); ++ int flags = d->allow_encoded_slashes && !d->decode_encoded_slashes ? PROXY_CANONENC_NOENCODEDSLASHENCODING : 0; ++ ++ path = ap_proxy_canonenc_ex(r->pool, url, strlen(url), enc_path, flags, ++ r->proxyreq); + search = r->args; + } + if (search && *(ap_scan_vchar_obstext(search))) { +diff --git a/modules/proxy/mod_proxy_fcgi.c b/modules/proxy/mod_proxy_fcgi.c +index a89b9a9..a422b4e 100644 +--- a/modules/proxy/mod_proxy_fcgi.c ++++ b/modules/proxy/mod_proxy_fcgi.c +@@ -97,8 +97,11 @@ static int proxy_fcgi_canon(request_rec *r, char *url) + path = url; /* this is the raw/encoded path */ + } + else { +- path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0, +- r->proxyreq); ++ core_dir_config *d = ap_get_core_module_config(r->per_dir_config); ++ int flags = d->allow_encoded_slashes && !d->decode_encoded_slashes ? PROXY_CANONENC_NOENCODEDSLASHENCODING : 0; ++ ++ path = ap_proxy_canonenc_ex(r->pool, url, strlen(url), enc_path, flags, ++ r->proxyreq); + } + if (path == NULL) + return HTTP_BAD_REQUEST; +diff --git a/modules/proxy/mod_proxy_ftp.c b/modules/proxy/mod_proxy_ftp.c +index a559528..e40d17c 100644 +--- a/modules/proxy/mod_proxy_ftp.c ++++ b/modules/proxy/mod_proxy_ftp.c +@@ -294,6 +294,8 @@ static int proxy_ftp_canon(request_rec *r, char *url) + apr_pool_t *p = r->pool; + const char *err; + apr_port_t port, def_port; ++ core_dir_config *d = ap_get_core_module_config(r->per_dir_config); ++ int flags = d->allow_encoded_slashes && !d->decode_encoded_slashes ? PROXY_CANONENC_NOENCODEDSLASHENCODING : 0; + + /* */ + if (ap_cstr_casecmpn(url, "ftp:", 4) == 0) { +@@ -332,7 +334,8 @@ static int proxy_ftp_canon(request_rec *r, char *url) + else + parms = ""; + +- path = ap_proxy_canonenc(p, url, strlen(url), enc_path, 0, r->proxyreq); ++ path = ap_proxy_canonenc_ex(p, url, strlen(url), enc_path, flags, ++ r->proxyreq); + if (path == NULL) + return HTTP_BAD_REQUEST; + if (!ftp_check_string(path)) +diff --git a/modules/proxy/mod_proxy_http.c b/modules/proxy/mod_proxy_http.c +index 4d0f8de..fca8d5d 100644 +--- a/modules/proxy/mod_proxy_http.c ++++ b/modules/proxy/mod_proxy_http.c +@@ -126,8 +126,11 @@ static int proxy_http_canon(request_rec *r, char *url) + search = r->args; + } + else { +- path = ap_proxy_canonenc(r->pool, url, strlen(url), +- enc_path, 0, r->proxyreq); ++ core_dir_config *d = ap_get_core_module_config(r->per_dir_config); ++ int flags = d->allow_encoded_slashes && !d->decode_encoded_slashes ? PROXY_CANONENC_NOENCODEDSLASHENCODING : 0; ++ ++ path = ap_proxy_canonenc_ex(r->pool, url, strlen(url), enc_path, ++ flags, r->proxyreq); + search = r->args; + } + if (search && *(ap_scan_vchar_obstext(search))) { +diff --git a/modules/proxy/mod_proxy_scgi.c b/modules/proxy/mod_proxy_scgi.c +index 493757d..5444a5c 100644 +--- a/modules/proxy/mod_proxy_scgi.c ++++ b/modules/proxy/mod_proxy_scgi.c +@@ -179,6 +179,8 @@ static int scgi_canon(request_rec *r, char *url) + char *host, sport[sizeof(":65535")]; + const char *err, *path; + apr_port_t port, def_port; ++ core_dir_config *d = ap_get_core_module_config(r->per_dir_config); ++ int flags = d->allow_encoded_slashes && !d->decode_encoded_slashes ? PROXY_CANONENC_NOENCODEDSLASHENCODING : 0; + + if (ap_cstr_casecmpn(url, SCHEME "://", sizeof(SCHEME) + 2)) { + return DECLINED; +@@ -205,8 +207,8 @@ static int scgi_canon(request_rec *r, char *url) + host = apr_pstrcat(r->pool, "[", host, "]", NULL); + } + +- path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0, +- r->proxyreq); ++ path = ap_proxy_canonenc_ex(r->pool, url, strlen(url), enc_path, flags, ++ r->proxyreq); + if (!path) { + return HTTP_BAD_REQUEST; + } +diff --git a/modules/proxy/mod_proxy_uwsgi.c b/modules/proxy/mod_proxy_uwsgi.c +index 71c6ebb..771fcea 100644 +--- a/modules/proxy/mod_proxy_uwsgi.c ++++ b/modules/proxy/mod_proxy_uwsgi.c +@@ -89,8 +89,11 @@ static int uwsgi_canon(request_rec *r, char *url) + path = url; /* this is the raw/encoded path */ + } + else { +- path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0, +- r->proxyreq); ++ core_dir_config *d = ap_get_core_module_config(r->per_dir_config); ++ int flags = d->allow_encoded_slashes && !d->decode_encoded_slashes ? PROXY_CANONENC_NOENCODEDSLASHENCODING : 0; ++ ++ path = ap_proxy_canonenc_ex(r->pool, url, strlen(url), enc_path, flags, ++ r->proxyreq); + } + if (!path) { + return HTTP_BAD_REQUEST; +diff --git a/modules/proxy/mod_proxy_wstunnel.c b/modules/proxy/mod_proxy_wstunnel.c +index 3f8de25..a44bb44 100644 +--- a/modules/proxy/mod_proxy_wstunnel.c ++++ b/modules/proxy/mod_proxy_wstunnel.c +@@ -115,8 +115,11 @@ static int proxy_wstunnel_canon(request_rec *r, char *url) + search = r->args; + } + else { +- path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0, +- r->proxyreq); ++ core_dir_config *d = ap_get_core_module_config(r->per_dir_config); ++ int flags = d->allow_encoded_slashes && !d->decode_encoded_slashes ? PROXY_CANONENC_NOENCODEDSLASHENCODING : 0; ++ ++ path = ap_proxy_canonenc_ex(r->pool, url, strlen(url), enc_path, flags, ++ r->proxyreq); + search = r->args; + } + if (search && *(ap_scan_vchar_obstext(search))) { +diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c +index 669b672..2dee743 100644 +--- a/modules/proxy/proxy_util.c ++++ b/modules/proxy/proxy_util.c +@@ -205,14 +205,16 @@ PROXY_DECLARE(void) ap_proxy_c2hex(int ch, char *x) + * and encodes those which must be encoded, and does not touch + * those which must not be touched. + */ +-PROXY_DECLARE(char *)ap_proxy_canonenc(apr_pool_t *p, const char *x, int len, +- enum enctype t, int forcedec, +- int proxyreq) ++PROXY_DECLARE(char *)ap_proxy_canonenc_ex(apr_pool_t *p, const char *x, int len, ++ enum enctype t, int flags, ++ int proxyreq) + { + int i, j, ch; + char *y; + char *allowed; /* characters which should not be encoded */ + char *reserved; /* characters which much not be en/de-coded */ ++ int forcedec = flags & PROXY_CANONENC_FORCEDEC; ++ int noencslashesenc = flags & PROXY_CANONENC_NOENCODEDSLASHENCODING; + + /* + * N.B. in addition to :@&=, this allows ';' in an http path +@@ -261,7 +263,8 @@ PROXY_DECLARE(char *)ap_proxy_canonenc(apr_pool_t *p, const char *x, int len, + * decode it if not already done. do not decode reverse proxied URLs + * unless specifically forced + */ +- if ((forcedec || (proxyreq && proxyreq != PROXYREQ_REVERSE)) && ch == '%') { ++ if ((forcedec || noencslashesenc ++ || (proxyreq && proxyreq != PROXYREQ_REVERSE)) && ch == '%') { + if (!apr_isxdigit(x[i + 1]) || !apr_isxdigit(x[i + 2])) { + return NULL; + } +@@ -272,7 +275,17 @@ PROXY_DECLARE(char *)ap_proxy_canonenc(apr_pool_t *p, const char *x, int len, + y[j] = x[i]; + continue; + } +- i += 2; ++ if (noencslashesenc && !forcedec && (proxyreq == PROXYREQ_REVERSE)) { ++ /* ++ * In the reverse proxy case when we only want to keep encoded ++ * slashes untouched revert back to '%' which will cause ++ * '%' to be encoded in the following. ++ */ ++ ch = '%'; ++ } ++ else { ++ i += 2; ++ } + } + /* recode it, if necessary */ + if (!apr_isalnum(ch) && !strchr(allowed, ch)) { +@@ -287,6 +300,22 @@ PROXY_DECLARE(char *)ap_proxy_canonenc(apr_pool_t *p, const char *x, int len, + return y; + } + ++/* ++ * Convert a URL-encoded string to canonical form. ++ * It decodes characters which need not be encoded, ++ * and encodes those which must be encoded, and does not touch ++ * those which must not be touched. ++ */ ++PROXY_DECLARE(char *)ap_proxy_canonenc(apr_pool_t *p, const char *x, int len, ++ enum enctype t, int forcedec, ++ int proxyreq) ++{ ++ int flags; ++ ++ flags = forcedec ? PROXY_CANONENC_FORCEDEC : 0; ++ return ap_proxy_canonenc_ex(p, x, len, t, flags, proxyreq); ++} ++ + /* + * Parses network-location. + * urlp on input the URL; on output the path, after the leading / +-- +2.27.0 + diff --git a/backport-Fix-double-encoding-of-the-uri-path-of-the-request.patch b/backport-Fix-double-encoding-of-the-uri-path-of-the-request.patch new file mode 100644 index 0000000000000000000000000000000000000000..192c2e57ff056c8ff1b8acfb8149a36708880b3d --- /dev/null +++ b/backport-Fix-double-encoding-of-the-uri-path-of-the-request.patch @@ -0,0 +1,258 @@ +From a356fdbfb93c59a4e359f0a81b38aef31ddd856e Mon Sep 17 00:00:00 2001 +From: Eric covener +Date: Mon, 20 Mar 2023 05:29:03 AM GMT+0800 +Subject: [PATCH] mod_proxy: Fix double encoding of the uri-path of the request forwarded + to the origin server, when using mapping=encoded|servlet + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/a356fdbfb93c59a4e359f0a81b38aef31ddd856e + +--- + modules/http2/mod_proxy_http2.c | 20 ++++++++++---------- + modules/proxy/mod_proxy.c | 17 +++++++++++------ + modules/proxy/mod_proxy_ajp.c | 20 ++++++++++---------- + modules/proxy/mod_proxy_balancer.c | 20 ++++++++++---------- + modules/proxy/mod_proxy_fcgi.c | 5 +++-- + modules/proxy/mod_proxy_http.c | 20 ++++++++++---------- + modules/proxy/mod_proxy_uwsgi.c | 10 ++++++++-- + modules/proxy/mod_proxy_wstunnel.c | 20 ++++++++++---------- + 8 files changed, 72 insertions(+), 60 deletions(-) + +diff --git a/modules/http2/mod_proxy_http2.c b/modules/http2/mod_proxy_http2.c +index 753f7f4..9b741e1 100644 +--- a/modules/http2/mod_proxy_http2.c ++++ b/modules/http2/mod_proxy_http2.c +@@ -162,16 +162,16 @@ static int proxy_http2_canon(request_rec *r, char *url) + path = ap_proxy_canonenc(r->pool, url, (int)strlen(url), + enc_path, 0, r->proxyreq); + search = r->args; +- if (search && *(ap_scan_vchar_obstext(search))) { +- /* +- * We have a raw control character or a ' ' in r->args. +- * Correct encoding was missed. +- */ +- ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10412) +- "To be forwarded query string contains control " +- "characters or spaces"); +- return HTTP_FORBIDDEN; +- } ++ } ++ if (search && *(ap_scan_vchar_obstext(search))) { ++ /* ++ * We have a raw control character or a ' ' in r->args. ++ * Correct encoding was missed. ++ */ ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10412) ++ "To be forwarded query string contains control " ++ "characters or spaces"); ++ return HTTP_FORBIDDEN; + } + break; + case PROXYREQ_PROXY: +diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c +index f8a4db6..6717782 100644 +--- a/modules/proxy/mod_proxy.c ++++ b/modules/proxy/mod_proxy.c +@@ -960,6 +960,8 @@ PROXY_DECLARE(int) ap_proxy_trans_match(request_rec *r, struct proxy_alias *ent, + } + + if (found) { ++ unsigned int encoded = ent->flags & PROXYPASS_MAP_ENCODED; ++ + /* A proxy module is assigned this URL, check whether it's interested + * in the request itself (e.g. proxy_wstunnel cares about Upgrade + * requests only, and could hand over to proxy_http otherwise). +@@ -979,6 +981,9 @@ PROXY_DECLARE(int) ap_proxy_trans_match(request_rec *r, struct proxy_alias *ent, + if (ent->flags & PROXYPASS_NOQUERY) { + apr_table_setn(r->notes, "proxy-noquery", "1"); + } ++ if (encoded) { ++ apr_table_setn(r->notes, "proxy-noencode", "1"); ++ } + + if (servlet_uri) { + ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, APLOGNO(10248) +@@ -992,13 +997,13 @@ PROXY_DECLARE(int) ap_proxy_trans_match(request_rec *r, struct proxy_alias *ent, + */ + AP_DEBUG_ASSERT(strlen(r->uri) >= strlen(servlet_uri)); + strcpy(r->uri, servlet_uri); +- return DONE; + } +- +- ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, APLOGNO(03464) +- "URI path '%s' matches proxy handler '%s'", r->uri, +- found); +- return OK; ++ else { ++ ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, APLOGNO(03464) ++ "URI path '%s' matches proxy handler '%s'", r->uri, ++ found); ++ } ++ return (encoded) ? DONE : OK; + } + + return HTTP_CONTINUE; +diff --git a/modules/proxy/mod_proxy_ajp.c b/modules/proxy/mod_proxy_ajp.c +index ba41fbd..731e4ed 100644 +--- a/modules/proxy/mod_proxy_ajp.c ++++ b/modules/proxy/mod_proxy_ajp.c +@@ -73,16 +73,16 @@ static int proxy_ajp_canon(request_rec *r, char *url) + path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0, + r->proxyreq); + search = r->args; +- if (search && *(ap_scan_vchar_obstext(search))) { +- /* +- * We have a raw control character or a ' ' in r->args. +- * Correct encoding was missed. +- */ +- ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10406) +- "To be forwarded query string contains control " +- "characters or spaces"); +- return HTTP_FORBIDDEN; +- } ++ } ++ if (search && *(ap_scan_vchar_obstext(search))) { ++ /* ++ * We have a raw control character or a ' ' in r->args. ++ * Correct encoding was missed. ++ */ ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10406) ++ "To be forwarded query string contains control " ++ "characters or spaces"); ++ return HTTP_FORBIDDEN; + } + if (path == NULL) + return HTTP_BAD_REQUEST; +diff --git a/modules/proxy/mod_proxy_balancer.c b/modules/proxy/mod_proxy_balancer.c +index c8bba0f..719a99e 100644 +--- a/modules/proxy/mod_proxy_balancer.c ++++ b/modules/proxy/mod_proxy_balancer.c +@@ -110,16 +110,16 @@ static int proxy_balancer_canon(request_rec *r, char *url) + path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0, + r->proxyreq); + search = r->args; +- if (search && *(ap_scan_vchar_obstext(search))) { +- /* +- * We have a raw control character or a ' ' in r->args. +- * Correct encoding was missed. +- */ +- ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10407) +- "To be forwarded query string contains control " +- "characters or spaces"); +- return HTTP_FORBIDDEN; +- } ++ } ++ if (search && *(ap_scan_vchar_obstext(search))) { ++ /* ++ * We have a raw control character or a ' ' in r->args. ++ * Correct encoding was missed. ++ */ ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10407) ++ "To be forwarded query string contains control " ++ "characters or spaces"); ++ return HTTP_FORBIDDEN; + } + if (path == NULL) + return HTTP_BAD_REQUEST; +diff --git a/modules/proxy/mod_proxy_fcgi.c b/modules/proxy/mod_proxy_fcgi.c +index 3382b9b..a89b9a9 100644 +--- a/modules/proxy/mod_proxy_fcgi.c ++++ b/modules/proxy/mod_proxy_fcgi.c +@@ -92,8 +92,9 @@ static int proxy_fcgi_canon(request_rec *r, char *url) + host = apr_pstrcat(r->pool, "[", host, "]", NULL); + } + +- if (apr_table_get(r->notes, "proxy-nocanon")) { +- path = url; /* this is the raw path */ ++ if (apr_table_get(r->notes, "proxy-nocanon") ++ || apr_table_get(r->notes, "proxy-noencode")) { ++ path = url; /* this is the raw/encoded path */ + } + else { + path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0, +diff --git a/modules/proxy/mod_proxy_http.c b/modules/proxy/mod_proxy_http.c +index 09269b2..4d0f8de 100644 +--- a/modules/proxy/mod_proxy_http.c ++++ b/modules/proxy/mod_proxy_http.c +@@ -129,16 +129,16 @@ static int proxy_http_canon(request_rec *r, char *url) + path = ap_proxy_canonenc(r->pool, url, strlen(url), + enc_path, 0, r->proxyreq); + search = r->args; +- if (search && *(ap_scan_vchar_obstext(search))) { +- /* +- * We have a raw control character or a ' ' in r->args. +- * Correct encoding was missed. +- */ +- ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10408) +- "To be forwarded query string contains control " +- "characters or spaces"); +- return HTTP_FORBIDDEN; +- } ++ } ++ if (search && *(ap_scan_vchar_obstext(search))) { ++ /* ++ * We have a raw control character or a ' ' in r->args. ++ * Correct encoding was missed. ++ */ ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10408) ++ "To be forwarded query string contains control " ++ "characters or spaces"); ++ return HTTP_FORBIDDEN; + } + break; + case PROXYREQ_PROXY: +diff --git a/modules/proxy/mod_proxy_uwsgi.c b/modules/proxy/mod_proxy_uwsgi.c +index cc21e38..71c6ebb 100644 +--- a/modules/proxy/mod_proxy_uwsgi.c ++++ b/modules/proxy/mod_proxy_uwsgi.c +@@ -84,8 +84,14 @@ static int uwsgi_canon(request_rec *r, char *url) + host = apr_pstrcat(r->pool, "[", host, "]", NULL); + } + +- path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0, +- r->proxyreq); ++ if (apr_table_get(r->notes, "proxy-nocanon") ++ || apr_table_get(r->notes, "proxy-noencode")) { ++ path = url; /* this is the raw/encoded path */ ++ } ++ else { ++ path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0, ++ r->proxyreq); ++ } + if (!path) { + return HTTP_BAD_REQUEST; + } +diff --git a/modules/proxy/mod_proxy_wstunnel.c b/modules/proxy/mod_proxy_wstunnel.c +index e2fcba2..3f8de25 100644 +--- a/modules/proxy/mod_proxy_wstunnel.c ++++ b/modules/proxy/mod_proxy_wstunnel.c +@@ -118,16 +118,16 @@ static int proxy_wstunnel_canon(request_rec *r, char *url) + path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0, + r->proxyreq); + search = r->args; +- if (search && *(ap_scan_vchar_obstext(search))) { +- /* +- * We have a raw control character or a ' ' in r->args. +- * Correct encoding was missed. +- */ +- ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10409) +- "To be forwarded query string contains control " +- "characters or spaces"); +- return HTTP_FORBIDDEN; +- } ++ } ++ if (search && *(ap_scan_vchar_obstext(search))) { ++ /* ++ * We have a raw control character or a ' ' in r->args. ++ * Correct encoding was missed. ++ */ ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10409) ++ "To be forwarded query string contains control " ++ "characters or spaces"); ++ return HTTP_FORBIDDEN; + } + if (path == NULL) + return HTTP_BAD_REQUEST; +-- +2.27.0 + diff --git a/backport-Fix-use-after-free-warning-with-gcc-fanalyzer.patch b/backport-Fix-use-after-free-warning-with-gcc-fanalyzer.patch new file mode 100644 index 0000000000000000000000000000000000000000..69856f7c0b079af2b898eac9fae4c6b228d8c00e --- /dev/null +++ b/backport-Fix-use-after-free-warning-with-gcc-fanalyzer.patch @@ -0,0 +1,74 @@ +From 8fe3cc79d1bcb4a20a0c56853d82e85c8a88b8f5 Mon Sep 17 00:00:00 2001 +From: Graham Leggett +Date: Mon, 20 Nov 2023 13:17:25 +0000 +Subject: [PATCH] Backport to v2.4: + + *) core: Fix use after free warning with gcc -fanalyzer. + trunk patch: http://svn.apache.org/r1892413 + 2.4.x patch: https://svn.apache.org/repos/asf/httpd/httpd/patches/2.4.x/httpd-2.4-use-after-free.patch + +1: minfrin, ylavic, jorton + + + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1913983 13f79535-47bb-0310-9956-ffa450edef68 + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/8fe3cc79d1bcb4a20a0c56853d82e85c8a88b8f5 + +--- + CHANGES | 2 ++ + server/mpm_unix.c | 16 ++++++++++------ + 2 files changed, 12 insertions(+), 6 deletions(-) + +diff --git a/CHANGES b/CHANGES +index 4cce3c0..e689384 100644 +--- a/CHANGES ++++ b/CHANGES +@@ -1,6 +1,8 @@ + -*- coding: utf-8 -*- + Changes with Apache 2.4.59 + ++ *) core: Fix use after free warning with gcc -fanalyzer. [Joe Orton] ++ + *) mod_ssl: release memory to the OS when needed. [Giovanni Bechis] + + Changes with Apache 2.4.51 +diff --git a/server/mpm_unix.c b/server/mpm_unix.c +index 8c4d233..ed4555a 100644 +--- a/server/mpm_unix.c ++++ b/server/mpm_unix.c +@@ -259,10 +259,12 @@ AP_DECLARE(void) ap_reclaim_child_processes(int terminate, + while (cur_extra) { + ap_generation_t old_gen; + extra_process_t *next = cur_extra->next; ++ pid_t pid = cur_extra->pid; + +- if (reclaim_one_pid(cur_extra->pid, action_table[cur_action].action)) { +- if (ap_unregister_extra_mpm_process(cur_extra->pid, &old_gen) == 1) { +- mpm_callback(-1, cur_extra->pid, old_gen); ++ if (reclaim_one_pid(pid, action_table[cur_action].action)) { ++ if (ap_unregister_extra_mpm_process(pid, &old_gen) == 1) { ++ /* cur_extra dangling pointer from here. */ ++ mpm_callback(-1, pid, old_gen); + } + else { + AP_DEBUG_ASSERT(1 == 0); +@@ -307,10 +309,12 @@ AP_DECLARE(void) ap_relieve_child_processes(ap_reclaim_callback_fn_t *mpm_callba + while (cur_extra) { + ap_generation_t old_gen; + extra_process_t *next = cur_extra->next; ++ pid_t pid = cur_extra->pid; + +- if (reclaim_one_pid(cur_extra->pid, DO_NOTHING)) { +- if (ap_unregister_extra_mpm_process(cur_extra->pid, &old_gen) == 1) { +- mpm_callback(-1, cur_extra->pid, old_gen); ++ if (reclaim_one_pid(pid, DO_NOTHING)) { ++ if (ap_unregister_extra_mpm_process(pid, &old_gen) == 1) { ++ /* cur_extra dangling pointer from here. */ ++ mpm_callback(-1, pid, old_gen); + } + else { + AP_DEBUG_ASSERT(1 == 0); +-- +2.33.0 + diff --git a/backport-Use-ap_os_is_path_absolute-to-make-it-portable.patch b/backport-Use-ap_os_is_path_absolute-to-make-it-portable.patch new file mode 100644 index 0000000000000000000000000000000000000000..a468867cb89a62212506b75e273b4be0c5a7b6f4 --- /dev/null +++ b/backport-Use-ap_os_is_path_absolute-to-make-it-portable.patch @@ -0,0 +1,55 @@ +From 32881a76e31f8bafa498999bae5237c3a6418317 Mon Sep 17 00:00:00 2001 +From: Jean-Frederic Clere +Date: Wed, 14 Feb 2024 14:27:03 +0000 +Subject: [PATCH] * mod_slotmem_shm: Use ap_os_is_path_absolute() to make it + portable. + +Reviewed by: jfclere, jorton, covener + + + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1915791 13f79535-47bb-0310-9956-ffa450edef68 + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/32881a76e31f8bafa498999bae5237c3a6418317 + +--- + changes-entries/mod_slotmem_shm.txt | 3 +++ + modules/slotmem/mod_slotmem_shm.c | 4 ++-- + 2 files changed, 5 insertions(+), 2 deletions(-) + create mode 100644 changes-entries/mod_slotmem_shm.txt + +diff --git a/changes-entries/mod_slotmem_shm.txt b/changes-entries/mod_slotmem_shm.txt +new file mode 100644 +index 0000000..767711f +--- /dev/null ++++ b/changes-entries/mod_slotmem_shm.txt +@@ -0,0 +1,3 @@ ++ *) mod_slotmem_shm: Use ap_os_is_path_absolute() to make it portable. ++ [Jean-Frederic Clere] ++ +diff --git a/modules/slotmem/mod_slotmem_shm.c b/modules/slotmem/mod_slotmem_shm.c +index f4eaa84..4d14faf 100644 +--- a/modules/slotmem/mod_slotmem_shm.c ++++ b/modules/slotmem/mod_slotmem_shm.c +@@ -92,7 +92,7 @@ static int slotmem_filenames(apr_pool_t *pool, + const char *fname = NULL, *pname = NULL; + + if (slotname && *slotname && strcasecmp(slotname, "none") != 0) { +- if (slotname[0] != '/') { ++ if (!ap_os_is_path_absolute(pool, slotname)) { + /* Each generation needs its own file name. */ + int generation = 0; + ap_mpm_query(AP_MPMQ_GENERATION, &generation); +@@ -109,7 +109,7 @@ static int slotmem_filenames(apr_pool_t *pool, + + if (persistname) { + /* Persisted file names are immutable... */ +- if (slotname[0] != '/') { ++ if (!ap_os_is_path_absolute(pool, slotname)) { + pname = apr_pstrcat(pool, DEFAULT_SLOTMEM_PREFIX, + slotname, DEFAULT_SLOTMEM_SUFFIX, + DEFAULT_SLOTMEM_PERSIST_SUFFIX, +-- +2.33.0 + diff --git a/backport-do-not-match-the-extention-against-possible-query-string.patch b/backport-do-not-match-the-extention-against-possible-query-string.patch new file mode 100644 index 0000000000000000000000000000000000000000..94309f7ae875f582e3c3aa32fc60bafcde311467 --- /dev/null +++ b/backport-do-not-match-the-extention-against-possible-query-string.patch @@ -0,0 +1,72 @@ +From 11d58d4a43939ccd6f0ab3e4bf762c6a9bc8e0a7 Mon Sep 17 00:00:00 2001 +From: Eric covener +Date: Mon, 20 Mar 2023 05:33:57 AM GMT+0800 +Subject: [PATCH] mod_mime: Do not match the extention against possible query string + parameters in case ProxyPass was used with the nocanon option. + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/11d58d4a43939ccd6f0ab3e4bf762c6a9bc8e0a7 + +--- + modules/http/mod_mime.c | 15 ++++++++++++++- + modules/proxy/proxy_util.c | 7 ++++--- + 2 files changed, 18 insertions(+), 4 deletions(-) + +diff --git a/modules/http/mod_mime.c b/modules/http/mod_mime.c +index 03d1c41..700f824 100644 +--- a/modules/http/mod_mime.c ++++ b/modules/http/mod_mime.c +@@ -755,7 +755,7 @@ static int find_ct(request_rec *r) + mime_dir_config *conf; + apr_array_header_t *exception_list; + char *ext; +- const char *fn, *fntmp, *type, *charset = NULL, *resource_name; ++ const char *fn, *fntmp, *type, *charset = NULL, *resource_name, *qm; + int found_metadata = 0; + + if (r->finfo.filetype == APR_DIR) { +@@ -775,6 +775,19 @@ static int find_ct(request_rec *r) + if (conf->use_path_info & 1) { + resource_name = apr_pstrcat(r->pool, r->filename, r->path_info, NULL); + } ++ /* ++ * In the reverse proxy case r->filename might contain a query string if ++ * the nocanon option was used with ProxyPass. ++ * If this is the case cut off the query string as the last parameter in ++ * this query string might end up on an extension we take care about, but ++ * we only want to match against path components not against query ++ * parameters. ++ */ ++ else if ((r->proxyreq == PROXYREQ_REVERSE) ++ && (apr_table_get(r->notes, "proxy-nocanon")) ++ && ((qm = ap_strchr_c(r->filename, '?')) != NULL)) { ++ resource_name = apr_pstrmemdup(r->pool, r->filename, qm - r->filename); ++ } + else { + resource_name = r->filename; + } +diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c +index 3d324cb..d824fb0 100644 +--- a/modules/proxy/proxy_util.c ++++ b/modules/proxy/proxy_util.c +@@ -266,12 +266,13 @@ PROXY_DECLARE(char *)ap_proxy_canonenc(apr_pool_t *p, const char *x, int len, + return NULL; + } + ch = ap_proxy_hex2c(&x[i + 1]); +- i += 2; + if (ch != 0 && strchr(reserved, ch)) { /* keep it encoded */ +- ap_proxy_c2hex(ch, &y[j]); +- j += 2; ++ y[j++] = x[i++]; ++ y[j++] = x[i++]; ++ y[j] = x[i]; + continue; + } ++ i += 2; + } + /* recode it, if necessary */ + if (!apr_isalnum(ch) && !strchr(allowed, ch)) { +-- +2.33.0 + + diff --git a/backport-fix-memory-leak-in-calc_sha256_hash.patch b/backport-fix-memory-leak-in-calc_sha256_hash.patch new file mode 100644 index 0000000000000000000000000000000000000000..e16fc2a2540655dd2f3a75603ad672eeaef38a91 --- /dev/null +++ b/backport-fix-memory-leak-in-calc_sha256_hash.patch @@ -0,0 +1,27 @@ +From ff558f52f528dd21eb0a77de74d828e1459cdd62 Mon Sep 17 00:00:00 2001 +From: Joe Orton +Date: Fri, 7 Jul 2023 08:04:38 PM GMT+0800 +Subject: [PATCH] fix memory leak in calc_sha256_hash + +Conflict:NA +Reference:https://github.com/apache/httpd/commmit/ff558f52f528dd21eb0a77de74d828e1459cdd62 + +--- + modules/http2/h2_push.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/modules/http2/h2_push.c b/modules/http2/h2_push.c +index 462c470..dd0928b 100644 +--- a/modules/http2/h2_push.c ++++ b/modules/http2/h2_push.c +@@ -502,6 +502,7 @@ static void calc_sha256_hash(h2_push_diary *diary, apr_uint64_t *phash, h2_push + sha256_update(md, push->req->authority); + sha256_update(md, push->req->path); + EVP_DigestFinal(md, hash, &len); ++ EVP_MD_CTX_destroy(md); + + val = 0; + for (i = 0; i != len; ++i) +-- +2.23.0 + diff --git a/backport-release-memory-to-the-OS-when-needed.patch b/backport-release-memory-to-the-OS-when-needed.patch new file mode 100644 index 0000000000000000000000000000000000000000..54a327ae3e6e2688733247c57681fa898800d518 --- /dev/null +++ b/backport-release-memory-to-the-OS-when-needed.patch @@ -0,0 +1,101 @@ +From 80560d29c8bc6dac44c8a7f7767e54e0ec52c5e6 Mon Sep 17 00:00:00 2001 +From: Graham Leggett +Date: Sat, 18 Nov 2023 11:20:14 +0000 +Subject: [PATCH] Backport to v2.4: + + *) mod_ssl: release memory to the OS when needed + Trunk version of patch: + https://svn.apache.org/r1898410 + https://svn.apache.org/r1898366 + svn merge -c 1898366 ^/httpd/httpd/trunk . + svn merge -c 1898410 ^/httpd/httpd/trunk . + +1: gbechis, ylavic, jorton + + + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1913909 13f79535-47bb-0310-9956-ffa450edef68 + +Conflict:The changelog contains context adaptation and does not contain the STATUS file +Reference:https://github.com/apache/httpd/commit/80560d29c8bc6dac44c8a7f7767e54e0ec52c5e6 + +--- + CHANGES | 4 ++++ + modules/ssl/ssl_engine_init.c | 7 ++++++- + modules/ssl/ssl_util_ocsp.c | 5 ++++- + modules/ssl/ssl_util_stapling.c | 4 +++- + 4 files changed, 17 insertions(+), 3 deletions(-) + +diff --git a/CHANGES b/CHANGES +index 093d46f..4cce3c0 100644 +--- a/CHANGES ++++ b/CHANGES +@@ -1,4 +1,8 @@ + -*- coding: utf-8 -*- ++Changes with Apache 2.4.59 ++ ++ *) mod_ssl: release memory to the OS when needed. [Giovanni Bechis] ++ + Changes with Apache 2.4.51 + + *) core: Add ap_unescape_url_ex() for better decoding control, and deprecate +diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c +index 8b8ede0..beb5dac 100644 +--- a/modules/ssl/ssl_engine_init.c ++++ b/modules/ssl/ssl_engine_init.c +@@ -1696,6 +1696,7 @@ static apr_status_t ssl_init_proxy_certs(server_rec *s, + ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(02208) + "SSL proxy client cert initialization failed"); + ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s); ++ sk_X509_INFO_free(sk); + return ssl_die(s); + } + +@@ -1705,7 +1706,11 @@ static apr_status_t ssl_init_proxy_certs(server_rec *s, + int i; + + X509_INFO *inf = sk_X509_INFO_value(pkp->certs, n); +- X509_STORE_CTX_init(sctx, store, inf->x509, NULL); ++ if (!X509_STORE_CTX_init(sctx, store, inf->x509, NULL)) { ++ sk_X509_INFO_free(sk); ++ X509_STORE_CTX_free(sctx); ++ return ssl_die(s); ++ } + + /* Attempt to verify the client cert */ + if (X509_verify_cert(sctx) != 1) { +diff --git a/modules/ssl/ssl_util_ocsp.c b/modules/ssl/ssl_util_ocsp.c +index b9c8a0b..a202a72 100644 +--- a/modules/ssl/ssl_util_ocsp.c ++++ b/modules/ssl/ssl_util_ocsp.c +@@ -370,8 +370,11 @@ static STACK_OF(X509) *modssl_read_ocsp_certificates(const char *file) + while ((x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL)) != NULL) { + if (!other_certs) { + other_certs = sk_X509_new_null(); +- if (!other_certs) ++ if (!other_certs) { ++ X509_free(x509); ++ BIO_free(bio); + return NULL; ++ } + } + + if (!sk_X509_push(other_certs, x509)) { +diff --git a/modules/ssl/ssl_util_stapling.c b/modules/ssl/ssl_util_stapling.c +index ab77e4a..25f2758 100644 +--- a/modules/ssl/ssl_util_stapling.c ++++ b/modules/ssl/ssl_util_stapling.c +@@ -117,8 +117,10 @@ static X509 *stapling_get_issuer(modssl_ctx_t *mctx, X509 *x) + } + + inctx = X509_STORE_CTX_new(); +- if (!X509_STORE_CTX_init(inctx, st, NULL, NULL)) ++ if (!X509_STORE_CTX_init(inctx, st, NULL, NULL)) { ++ X509_STORE_CTX_free(inctx); + return 0; ++ } + if (X509_STORE_CTX_get1_issuer(&issuer, inctx, x) <= 0) + issuer = NULL; + X509_STORE_CTX_cleanup(inctx); +-- +2.33.0 + diff --git a/httpd.spec b/httpd.spec index 0c3c0c910997e224071d6ade13f1730b96641901..1dcb99d945d68f5318e762ba078eb76fc7863287 100644 --- a/httpd.spec +++ b/httpd.spec @@ -8,7 +8,7 @@ Name: httpd Summary: Apache HTTP Server Version: 2.4.51 -Release: 20 +Release: 21 License: ASL 2.0 URL: https://httpd.apache.org/ Source0: https://archive.apache.org/dist/httpd/httpd-%{version}.tar.bz2 @@ -104,8 +104,19 @@ Patch50: backport-Report-an-error-if-the-AJP-backend-sends-an-invalid-n Patch51: backport-handled-a-negative-value-when-parsing-the-config.patch Patch52: backport-avoid-delimiting-the-query-with-a-backreference.patch Patch53: backport-fix-missing-APLOGNO.patch -Patch54: backport-CVE-2023-31122-out-of-bound-Read.patch -Patch55: backport-CVE-2023-45802-improved-early-cleanup-of-streams.patch +Patch54: backport-Fix-double-encoding-of-the-uri-path-of-the-request.patch +Patch55: backport-do-not-match-the-extention-against-possible-query-string.patch +Patch56: backport-Do-not-double-encode-encoded-slashes.patch +Patch57: backport-Check-before-forwarding-that-a-nocanon-path-has-not-been-rewritten.patch +Patch58: backport-fix-memory-leak-in-calc_sha256_hash.patch +Patch59: backport-CVE-2023-31122-out-of-bound-Read.patch +Patch60: backport-CVE-2023-45802-improved-early-cleanup-of-streams.patch +Patch61: backport-release-memory-to-the-OS-when-needed.patch +Patch62: backport-Fix-use-after-free-warning-with-gcc-fanalyzer.patch +Patch63: backport-Use-ap_os_is_path_absolute-to-make-it-portable.patch +Patch64: backport-CVE-2024-24795-let-httpd-handle-CL-TE-for-non-http-handlers.patch +Patch65: backport-CVE-2023-38709-header-validation-after-content.patch +Patch66: backport-CVE-2024-27316-bail-after-too-many-failed-reads.patch BuildRequires: gcc autoconf pkgconfig findutils xmlto perl-interpreter perl-generators systemd-devel BuildRequires: zlib-devel libselinux-devel lua-devel brotli-devel @@ -542,6 +553,12 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Tue May 07 2024 chengyechun - 2.4.51-21 +- Type:CVE +- ID:CVE-2024-24795,CVE-2023-38709,CVE-2024-27316 +- SUG:NA +- DESC:fix CVE-2024-24795,CVE-2023-38709,CVE-2024-27316 and sync some patches from upstream + * Fri Nov 10 2023 chengyechun - 2.4.51-20 - Type:bugfix - ID: