diff --git a/backport-CVE-2024-38473-CVE-2024-39573-block-inadvertent-subst-of-special-filename.patch b/backport-CVE-2024-38473-CVE-2024-39573-block-inadvertent-subst-of-special-filename.patch new file mode 100644 index 0000000000000000000000000000000000000000..b3709ca3e5b8d2cd66598b89f28c9406fcb7a1ae --- /dev/null +++ b/backport-CVE-2024-38473-CVE-2024-39573-block-inadvertent-subst-of-special-filename.patch @@ -0,0 +1,79 @@ +From 93aec0e3ca451bcc97f6d91c14d5399d13a73365 Mon Sep 17 00:00:00 2001 +From: Eric Covener +Date: Tue, 25 Jun 2024 15:28:00 +0000 +Subject: [PATCH] Merge r1918553 from trunk: + +block inadvertent subst of special filenames + ++ cosmetic merge conflicts + + + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918600 13f79535-47bb-0310-9956-ffa450edef68 + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/93aec0e3ca451bcc97f6d91c14d5399d13a73365 + +--- + modules/mappers/mod_rewrite.c | 38 ++++++++++++++++++++++++----------- + 1 file changed, 26 insertions(+), 12 deletions(-) + +diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c +index 80fdbde..86348b3 100644 +--- a/modules/mappers/mod_rewrite.c ++++ b/modules/mappers/mod_rewrite.c +@@ -4208,6 +4208,32 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + return 2; + } + ++ /* Add the previously stripped per-directory location prefix, unless ++ * (1) it's an absolute URL path and ++ * (2) it's a full qualified URL ++ */ ++ if (!is_proxyreq && *newuri != '/' && !is_absolute_uri(newuri, NULL)) { ++ if (ctx->perdir) { ++ rewritelog((r, 3, ctx->perdir, "add per-dir prefix: %s -> %s%s", ++ newuri, ctx->perdir, newuri)); ++ ++ newuri = apr_pstrcat(r->pool, ctx->perdir, newuri, NULL); ++ } ++ else if (!(p->flags & (RULEFLAG_PROXY | RULEFLAG_FORCEREDIRECT))) { ++ /* Not an absolute URI-path and the scheme (if any) is unknown, ++ * and it won't be passed to fully_qualify_uri() below either, ++ * so add an implicit '/' prefix. This avoids potentially a common ++ * rule like "RewriteRule ^/some/path(.*) $1" that is given a path ++ * like "/some/pathscheme:..." to produce the fully qualified URL ++ * "scheme:..." which could be misinterpreted later. ++ */ ++ rewritelog((r, 3, ctx->perdir, "add root prefix: %s -> /%s", ++ newuri, newuri)); ++ ++ newuri = apr_pstrcat(r->pool, "/", newuri, NULL); ++ } ++ } ++ + /* Now adjust API's knowledge about r->filename and r->args */ + r->filename = newuri; + +@@ -4219,18 +4245,6 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + p->flags & RULEFLAG_QSDISCARD, + p->flags & RULEFLAG_QSLAST); + +- /* Add the previously stripped per-directory location prefix, unless +- * (1) it's an absolute URL path and +- * (2) it's a full qualified URL +- */ +- if ( ctx->perdir && !is_proxyreq && *r->filename != '/' +- && !is_absolute_uri(r->filename, NULL)) { +- rewritelog((r, 3, ctx->perdir, "add per-dir prefix: %s -> %s%s", +- r->filename, ctx->perdir, r->filename)); +- +- r->filename = apr_pstrcat(r->pool, ctx->perdir, r->filename, NULL); +- } +- + /* If this rule is forced for proxy throughput + * (`RewriteRule ... ... [P]') then emulate mod_proxy's + * URL-to-filename handler to be sure mod_proxy is triggered +-- +2.33.0 + diff --git a/backport-CVE-2024-38473-fix-comparsion-of-local-path.patch b/backport-CVE-2024-38473-fix-comparsion-of-local-path.patch new file mode 100644 index 0000000000000000000000000000000000000000..d9b07a57f16e2ae0901c1110ff0a47691a87af23 --- /dev/null +++ b/backport-CVE-2024-38473-fix-comparsion-of-local-path.patch @@ -0,0 +1,58 @@ +From cc00cf6b4e37370897daddc307bf1deecf8fedfa Mon Sep 17 00:00:00 2001 +From: Eric Covener +Date: Tue, 25 Jun 2024 20:20:05 +0000 +Subject: [PATCH] Merge r1918623 from trunk: + +fix comparison of local path on Windows + +Submitted By: Yann Ylavic + + + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918625 13f79535-47bb-0310-9956-ffa450edef68 + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/cc00cf6b4e37370897daddc307bf1deecf8fedfa + +--- + modules/mappers/mod_rewrite.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c +index 86348b3..9149023 100644 +--- a/modules/mappers/mod_rewrite.c ++++ b/modules/mappers/mod_rewrite.c +@@ -632,6 +632,19 @@ static unsigned is_absolute_uri(char *uri, int *supportsqs) + return 0; + } + ++static int is_absolute_path(const char *path) ++{ ++#ifndef WIN32 ++ return (path[0] == '/'); ++#else ++#define IS_SLASH(c) ((c) == '/' || (c) == '\\') ++ /* "//", "\\", "x:/" and "x:\" are absolute paths on Windows */ ++ return ((IS_SLASH(path[0]) && path[1] == path[0]) ++ || (apr_isalpha(path[0]) && path[1] == ':' && IS_SLASH(path[2]))); ++#undef IS_SLASH ++#endif ++} ++ + static const char c2x_table[] = "0123456789abcdef"; + + static APR_INLINE unsigned char *c2x(unsigned what, unsigned char prefix, +@@ -4212,7 +4225,9 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + * (1) it's an absolute URL path and + * (2) it's a full qualified URL + */ +- if (!is_proxyreq && *newuri != '/' && !is_absolute_uri(newuri, NULL)) { ++ if (!is_proxyreq ++ && !is_absolute_path(newuri) ++ && !is_absolute_uri(newuri, NULL)) { + if (ctx->perdir) { + rewritelog((r, 3, ctx->perdir, "add per-dir prefix: %s -> %s%s", + newuri, ctx->perdir, newuri)); +-- +2.33.0 + diff --git a/backport-CVE-2024-38473-fix-the-filename-redirected.patch b/backport-CVE-2024-38473-fix-the-filename-redirected.patch new file mode 100644 index 0000000000000000000000000000000000000000..0ce09f8cb08de6f2fc100c3a26a4860c8e70c455 --- /dev/null +++ b/backport-CVE-2024-38473-fix-the-filename-redirected.patch @@ -0,0 +1,204 @@ +From 4326d6b9041a3bcb9b529f9163d0761c2d760700 Mon Sep 17 00:00:00 2001 +From: Yann Ylavic +Date: Wed, 26 Jun 2024 14:56:47 +0000 +Subject: [PATCH] factor out IS_SLASH, perdir fix + +in per-dir, the filename will be internally redirected, so / is OK too. + + +don't add / to / in the non-perdir + + +match AP_IS_SLASH macro + +followup to 1918651 + + +Merges r1918651, r1918652, r1918663 from trunk +Reviewed by: covener, ylavic, rpluem +GH: close #458 + + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918668 13f79535-47bb-0310-9956-ffa450edef68 + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/4326d6b9041a3bcb9b529f9163d0761c2d760700 + +--- + include/ap_mmn.h | 3 ++- + include/httpd.h | 11 +++++++++++ + modules/mappers/mod_rewrite.c | 11 ++++------- + server/util.c | 31 ++++++++++--------------------- + 4 files changed, 27 insertions(+), 29 deletions(-) + +diff --git a/include/ap_mmn.h b/include/ap_mmn.h +index ab88f82..76600b7 100644 +--- a/include/ap_mmn.h ++++ b/include/ap_mmn.h +@@ -541,6 +541,7 @@ + * flush_max_threshold and flush_max_pipelined to + * core_server_config, and ap_get_read_buf_size(). + * 20120211.133 (2.4.60-dev) Add ap_proxy_fixup_uds_filename() ++ * 20120211.134 (2.4.60-dev) AP_SLASHES and AP_IS_SLASH + */ + + #define MODULE_MAGIC_COOKIE 0x41503234UL /* "AP24" */ +@@ -548,7 +549,7 @@ + #ifndef MODULE_MAGIC_NUMBER_MAJOR + #define MODULE_MAGIC_NUMBER_MAJOR 20120211 + #endif +-#define MODULE_MAGIC_NUMBER_MINOR 133 /* 0...n */ ++#define MODULE_MAGIC_NUMBER_MINOR 134 /* 0...n */ + + /** + * Determine if the server's current MODULE_MAGIC_NUMBER is at least a +diff --git a/include/httpd.h b/include/httpd.h +index f5e64cc..acb4c5f 100644 +--- a/include/httpd.h ++++ b/include/httpd.h +@@ -2504,6 +2504,17 @@ AP_DECLARE(const char *)ap_dir_fnmatch(ap_dir_match_t *w, const char *path, + */ + AP_DECLARE(int) ap_is_chunked(apr_pool_t *p, const char *line); + ++/* Win32/NetWare/OS2 need to check for both forward and back slashes ++ * in ap_normalize_path() and ap_escape_url(). ++ */ ++#ifdef CASE_BLIND_FILESYSTEM ++#define AP_IS_SLASH(s) ((s == '/') || (s == '\\')) ++#define AP_SLASHES "/\\" ++#else ++#define AP_IS_SLASH(s) (s == '/') ++#define AP_SLASHES "/" ++#endif ++ + #ifdef __cplusplus + } + #endif +diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c +index 9149023..a0f67a8 100644 +--- a/modules/mappers/mod_rewrite.c ++++ b/modules/mappers/mod_rewrite.c +@@ -634,14 +634,11 @@ static unsigned is_absolute_uri(char *uri, int *supportsqs) + + static int is_absolute_path(const char *path) + { +-#ifndef WIN32 ++#ifndef CASE_BLIND_FILESYSTEM + return (path[0] == '/'); + #else +-#define IS_SLASH(c) ((c) == '/' || (c) == '\\') +- /* "//", "\\", "x:/" and "x:\" are absolute paths on Windows */ +- return ((IS_SLASH(path[0]) && path[1] == path[0]) +- || (apr_isalpha(path[0]) && path[1] == ':' && IS_SLASH(path[2]))); +-#undef IS_SLASH ++ return ((AP_IS_SLASH(path[0]) && path[1] == path[0]) ++ || (apr_isalpha(path[0]) && path[1] == ':' && AP_IS_SLASH(path[2]))); + #endif + } + +@@ -4227,11 +4224,11 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + */ + if (!is_proxyreq + && !is_absolute_path(newuri) ++ && !AP_IS_SLASH(*newuri) + && !is_absolute_uri(newuri, NULL)) { + if (ctx->perdir) { + rewritelog((r, 3, ctx->perdir, "add per-dir prefix: %s -> %s%s", + newuri, ctx->perdir, newuri)); +- + newuri = apr_pstrcat(r->pool, ctx->perdir, newuri, NULL); + } + else if (!(p->flags & (RULEFLAG_PROXY | RULEFLAG_FORCEREDIRECT))) { +diff --git a/server/util.c b/server/util.c +index 0f05110..1bdfe70 100644 +--- a/server/util.c ++++ b/server/util.c +@@ -75,17 +75,6 @@ + */ + #include "test_char.h" + +-/* Win32/NetWare/OS2 need to check for both forward and back slashes +- * in ap_getparents() and ap_escape_url. +- */ +-#ifdef CASE_BLIND_FILESYSTEM +-#define IS_SLASH(s) ((s == '/') || (s == '\\')) +-#define SLASHES "/\\" +-#else +-#define IS_SLASH(s) (s == '/') +-#define SLASHES "/" +-#endif +- + /* we know core's module_index is 0 */ + #undef APLOG_MODULE_INDEX + #define APLOG_MODULE_INDEX AP_CORE_MODULE_INDEX +@@ -506,8 +495,8 @@ AP_DECLARE(void) ap_getparents(char *name) + + l = w = first_dot = next - name; + while (name[l] != '\0') { +- if (name[l] == '.' && IS_SLASH(name[l + 1]) +- && (l == 0 || IS_SLASH(name[l - 1]))) ++ if (name[l] == '.' && AP_IS_SLASH(name[l + 1]) ++ && (l == 0 || AP_IS_SLASH(name[l - 1]))) + l += 2; + else + name[w++] = name[l++]; +@@ -516,7 +505,7 @@ AP_DECLARE(void) ap_getparents(char *name) + /* b) remove trailing . path, segment */ + if (w == 1 && name[0] == '.') + w--; +- else if (w > 1 && name[w - 1] == '.' && IS_SLASH(name[w - 2])) ++ else if (w > 1 && name[w - 1] == '.' && AP_IS_SLASH(name[w - 2])) + w--; + name[w] = '\0'; + +@@ -524,13 +513,13 @@ AP_DECLARE(void) ap_getparents(char *name) + l = first_dot; + + while (name[l] != '\0') { +- if (name[l] == '.' && name[l + 1] == '.' && IS_SLASH(name[l + 2]) +- && (l == 0 || IS_SLASH(name[l - 1]))) { ++ if (name[l] == '.' && name[l + 1] == '.' && AP_IS_SLASH(name[l + 2]) ++ && (l == 0 || AP_IS_SLASH(name[l - 1]))) { + int m = l + 3, n; + + l = l - 2; + if (l >= 0) { +- while (l >= 0 && !IS_SLASH(name[l])) ++ while (l >= 0 && !AP_IS_SLASH(name[l])) + l--; + l++; + } +@@ -548,10 +537,10 @@ AP_DECLARE(void) ap_getparents(char *name) + if (l == 2 && name[0] == '.' && name[1] == '.') + name[0] = '\0'; + else if (l > 2 && name[l - 1] == '.' && name[l - 2] == '.' +- && IS_SLASH(name[l - 3])) { ++ && AP_IS_SLASH(name[l - 3])) { + l = l - 4; + if (l >= 0) { +- while (l >= 0 && !IS_SLASH(name[l])) ++ while (l >= 0 && !AP_IS_SLASH(name[l])) + l--; + l++; + } +@@ -1884,7 +1873,7 @@ static int unescape_url(char *url, const char *forbid, const char *reserved) + AP_DECLARE(int) ap_unescape_url(char *url) + { + /* Traditional */ +- return unescape_url(url, SLASHES, NULL); ++ return unescape_url(url, AP_SLASHES, NULL); + } + AP_DECLARE(int) ap_unescape_url_keep2f(char *url, int decode_slashes) + { +@@ -1894,7 +1883,7 @@ AP_DECLARE(int) ap_unescape_url_keep2f(char *url, int decode_slashes) + return unescape_url(url, NULL, NULL); + } else { + /* reserve (do not decode) encoded slashes */ +- return unescape_url(url, NULL, SLASHES); ++ return unescape_url(url, NULL, AP_SLASHES); + } + } + #ifdef NEW_APIS +-- +2.33.0 + diff --git a/backport-CVE-2024-38473-mod_proxy-Fixup-UDS-filename.patch b/backport-CVE-2024-38473-mod_proxy-Fixup-UDS-filename.patch new file mode 100644 index 0000000000000000000000000000000000000000..91c5d224c8af8ddba64e19136282579356d2e1ef --- /dev/null +++ b/backport-CVE-2024-38473-mod_proxy-Fixup-UDS-filename.patch @@ -0,0 +1,236 @@ +From 6b8e043ce4f27114e6ae1b8176b629b7cb3fbbce Mon Sep 17 00:00:00 2001 +From: Yann Ylavic +Date: Wed, 26 Jun 2024 14:51:32 +0000 +Subject: [PATCH] mod_proxy: Fixup UDS filename for mod_proxy called through + r->handler. + +* modules/proxy/proxy_util.c: + Export ap_proxy_fixup_uds_filename() from fix_uds_filename. + Call it from ap_proxy_pre_request() even for rewritten balancer workers. + +* modules/proxy/mod_proxy.h: + Declare ap_proxy_fixup_uds_filename() + +* modules/proxy/mod_proxy.c: + Fixup UDS filename from r->handler in proxy_handler(). + +* include/ap_mmn.h: + Bump MMN minor for ap_proxy_fixup_uds_filename() + + +mod_proxy: follow up to r1918626: Simplify ap_proxy_fixup_uds_filename() and callers. + + +Merges r1918626, r1918647 from trunk +GH: closes #457 + + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918666 13f79535-47bb-0310-9956-ffa450edef68 + +Conflict:Version adaptation exists in ap_mmn.h +Reference:https://github.com/apache/httpd/commit/6b8e043ce4f27114e6ae1b8176b629b7cb3fbbce + +--- + include/ap_mmn.h | 3 ++- + modules/proxy/mod_proxy.c | 33 ++++++++++++++++++------------ + modules/proxy/mod_proxy.h | 8 ++++++++ + modules/proxy/proxy_util.c | 41 ++++++++++++++++++++++---------------- + 4 files changed, 54 insertions(+), 31 deletions(-) + +diff --git a/include/ap_mmn.h b/include/ap_mmn.h +index 2d87cb6..ab88f82 100644 +--- a/include/ap_mmn.h ++++ b/include/ap_mmn.h +@@ -540,6 +540,7 @@ + * 20120211.94 (2.4.47-dev) Add read_buf_size member to core_dir_config, + * flush_max_threshold and flush_max_pipelined to + * core_server_config, and ap_get_read_buf_size(). ++ * 20120211.133 (2.4.60-dev) Add ap_proxy_fixup_uds_filename() + */ + + #define MODULE_MAGIC_COOKIE 0x41503234UL /* "AP24" */ +@@ -547,7 +548,7 @@ + #ifndef MODULE_MAGIC_NUMBER_MAJOR + #define MODULE_MAGIC_NUMBER_MAJOR 20120211 + #endif +-#define MODULE_MAGIC_NUMBER_MINOR 94 /* 0...n */ ++#define MODULE_MAGIC_NUMBER_MINOR 133 /* 0...n */ + + /** + * Determine if the server's current MODULE_MAGIC_NUMBER is at least a +diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c +index 0ba890a..a54fa75 100644 +--- a/modules/proxy/mod_proxy.c ++++ b/modules/proxy/mod_proxy.c +@@ -969,6 +969,7 @@ static int proxy_fixup(request_rec *r) + + return OK; /* otherwise; we've done the best we can */ + } ++ + /* Send a redirection if the request contains a hostname which is not */ + /* fully qualified, i.e. doesn't have a domain name appended. Some proxy */ + /* servers like Netscape's allow this and access hosts from the local */ +@@ -1022,7 +1023,7 @@ static int proxy_handler(request_rec *r) + ap_get_module_config(sconf, &proxy_module); + apr_array_header_t *proxies = conf->proxies; + struct proxy_remote *ents = (struct proxy_remote *) proxies->elts; +- int i, rc, access_status; ++ int rc = DECLINED, access_status, i; + int direct_connect = 0; + const char *str; + apr_int64_t maxfwd; +@@ -1037,22 +1038,28 @@ static int proxy_handler(request_rec *r) + return DECLINED; + } + +- if (!r->proxyreq) { +- rc = DECLINED; +- /* We may have forced the proxy handler via config or .htaccess */ +- if (r->handler && +- strncmp(r->handler, "proxy:", 6) == 0 && +- strncmp(r->filename, "proxy:", 6) != 0) { +- r->proxyreq = PROXYREQ_REVERSE; +- r->filename = apr_pstrcat(r->pool, r->handler, r->filename, NULL); +- /* Still need to fixup/canonicalize r->filename */ ++ /* We may have forced the proxy handler via config or .htaccess */ ++ if (!r->proxyreq && r->handler && strncmp(r->handler, "proxy:", 6) == 0) { ++ char *old_filename = r->filename; ++ ++ r->proxyreq = PROXYREQ_REVERSE; ++ r->filename = apr_pstrcat(r->pool, r->handler, r->filename, NULL); ++ ++ /* Still need to fixup/canonicalize r->filename */ ++ rc = ap_proxy_fixup_uds_filename(r); ++ if (rc <= OK) { + rc = proxy_fixup(r); + } + if (rc != OK) { +- return rc; ++ r->filename = old_filename; ++ r->proxyreq = 0; + } +- } else if (strncmp(r->filename, "proxy:", 6) != 0) { +- return DECLINED; ++ } ++ else if (r->proxyreq && strncmp(r->filename, "proxy:", 6) == 0) { ++ rc = OK; ++ } ++ if (rc != OK) { ++ return rc; + } + + /* handle max-forwards / OPTIONS / TRACE */ +diff --git a/modules/proxy/mod_proxy.h b/modules/proxy/mod_proxy.h +index e522a96..0a8e1c4 100644 +--- a/modules/proxy/mod_proxy.h ++++ b/modules/proxy/mod_proxy.h +@@ -912,6 +912,14 @@ PROXY_DECLARE(proxy_balancer_shared *) ap_proxy_find_balancershm(ap_slotmem_prov + proxy_balancer *balancer, + unsigned int *index); + ++/* ++ * Strip the UDS part of r->filename if any, and put the UDS path in ++ * r->notes ("uds_path") ++ * @param r current request ++ * @return OK if fixed up, DECLINED if not UDS, or an HTTP_XXX error ++ */ ++PROXY_DECLARE(int) ap_proxy_fixup_uds_filename(request_rec *r); ++ + /** + * Get the most suitable worker and/or balancer for the request + * @param worker worker used for processing request +diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c +index 7ae239e..79e12fc 100644 +--- a/modules/proxy/proxy_util.c ++++ b/modules/proxy/proxy_util.c +@@ -2121,7 +2121,7 @@ static int ap_proxy_retry_worker(const char *proxy_function, proxy_worker *worke + * were passed a UDS url (eg: from mod_proxy) and adjust uds_path + * as required. + */ +-static int fix_uds_filename(request_rec *r, char **url) ++PROXY_DECLARE(int) ap_proxy_fixup_uds_filename(request_rec *r) + { + char *uds_url = r->filename + 6, *origin_url; + +@@ -2129,7 +2129,6 @@ static int fix_uds_filename(request_rec *r, char **url) + !ap_cstr_casecmpn(uds_url, "unix:", 5) && + (origin_url = ap_strchr(uds_url + 5, '|'))) { + char *uds_path = NULL; +- apr_size_t url_len; + apr_uri_t urisock; + apr_status_t rv; + +@@ -2144,20 +2143,20 @@ static int fix_uds_filename(request_rec *r, char **url) + if (!uds_path) { + ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10292) + "Invalid proxy UDS filename (%s)", r->filename); +- return 0; ++ return HTTP_BAD_REQUEST; + } + apr_table_setn(r->notes, "uds_path", uds_path); + +- /* Remove the UDS path from *url and r->filename */ +- url_len = strlen(origin_url); +- *url = apr_pstrmemdup(r->pool, origin_url, url_len); +- memcpy(uds_url, *url, url_len + 1); +- + ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r, +- "*: rewrite of url due to UDS(%s): %s (%s)", +- uds_path, *url, r->filename); ++ "*: fixup UDS from %s: %s (%s)", ++ r->filename, origin_url, uds_path); ++ ++ /* Overwrite the UDS part in place */ ++ memmove(uds_url, origin_url, strlen(origin_url) + 1); ++ return OK; + } +- return 1; ++ ++ return DECLINED; + } + + PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker, +@@ -2175,9 +2174,6 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker, + ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r, + "%s: found worker %s for %s", + (*worker)->s->scheme, (*worker)->s->name, *url); +- if (!forward && !fix_uds_filename(r, url)) { +- return HTTP_INTERNAL_SERVER_ERROR; +- } + access_status = OK; + } + else if (forward) { +@@ -2207,9 +2203,6 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker, + * regarding the Connection header in the request. + */ + apr_table_setn(r->subprocess_env, "proxy-nokeepalive", "1"); +- if (!fix_uds_filename(r, url)) { +- return HTTP_INTERNAL_SERVER_ERROR; +- } + } + } + } +@@ -2219,6 +2212,20 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker, + "all workers are busy. Unable to serve %s", *url); + access_status = HTTP_SERVICE_UNAVAILABLE; + } ++ ++ if (access_status == OK && r->proxyreq == PROXYREQ_REVERSE) { ++ int rc = ap_proxy_fixup_uds_filename(r); ++ if (ap_is_HTTP_ERROR(rc)) { ++ return rc; ++ } ++ /* If the URL has changed in r->filename, take everything after ++ * the "proxy:" prefix. ++ */ ++ if (rc == OK) { ++ *url = apr_pstrdup(r->pool, r->filename + 6); ++ } ++ } ++ + return access_status; + } + +-- +2.33.0 + diff --git a/backport-CVE-2024-38473-mod_proxy-escape-for-non-proxypass-configuration.patch b/backport-CVE-2024-38473-mod_proxy-escape-for-non-proxypass-configuration.patch new file mode 100644 index 0000000000000000000000000000000000000000..e568872f112da9877927b01b0e8f059d3d9aeb0c --- /dev/null +++ b/backport-CVE-2024-38473-mod_proxy-escape-for-non-proxypass-configuration.patch @@ -0,0 +1,44 @@ +From b10cb2d69184843832d501a615abe3e8e5e256dc Mon Sep 17 00:00:00 2001 +From: Eric Covener +Date: Mon, 24 Jun 2024 17:52:31 +0000 +Subject: [PATCH] Merge r1918550 from trunk: + +mod_proxy: escape for non-proxypass configuration + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918559 13f79535-47bb-0310-9956-ffa450edef68 + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/b10cb2d69184843832d501a615abe3e8e5e256dc + +--- + modules/proxy/mod_proxy.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c +index 8a891ee..0ba890a 100644 +--- a/modules/proxy/mod_proxy.c ++++ b/modules/proxy/mod_proxy.c +@@ -1038,15 +1038,18 @@ static int proxy_handler(request_rec *r) + } + + if (!r->proxyreq) { ++ rc = DECLINED; + /* We may have forced the proxy handler via config or .htaccess */ + if (r->handler && + strncmp(r->handler, "proxy:", 6) == 0 && + strncmp(r->filename, "proxy:", 6) != 0) { + r->proxyreq = PROXYREQ_REVERSE; + r->filename = apr_pstrcat(r->pool, r->handler, r->filename, NULL); ++ /* Still need to fixup/canonicalize r->filename */ ++ rc = proxy_fixup(r); + } +- else { +- return DECLINED; ++ if (rc != OK) { ++ return rc; + } + } else if (strncmp(r->filename, "proxy:", 6) != 0) { + return DECLINED; +-- +2.33.0 + diff --git a/backport-CVE-2024-38474-CVE-2024-38475-tighten-up-prefix_stat.patch b/backport-CVE-2024-38474-CVE-2024-38475-tighten-up-prefix_stat.patch new file mode 100644 index 0000000000000000000000000000000000000000..d1083ca09793085143a321a330c72ef02b82fb4a --- /dev/null +++ b/backport-CVE-2024-38474-CVE-2024-38475-tighten-up-prefix_stat.patch @@ -0,0 +1,405 @@ +From 1feb5e04a4f7b5f3f13cd40f9635144319dcf24a Mon Sep 17 00:00:00 2001 +From: Eric Covener +Date: Mon, 24 Jun 2024 17:58:17 +0000 +Subject: [PATCH] Merge r1918552 from trunk: + +tighten up prefix_stat and %3f handling + +Require opt-ins for unsafe substitutions + + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918561 13f79535-47bb-0310-9956-ffa450edef68 + +Conflict:The XML file does not exist. Therefore, the file is not modified. +Reference:https://github.com/apache/httpd/commit/1feb5e04a4f7b5f3f13cd40f9635144319dcf24a + +--- + modules/mappers/mod_rewrite.c | 151 +++++++++++++++++++++++++++------- + 1 file changed, 123 insertions(+), 28 deletions(-) + +diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c +index a0f67a8..10a215e 100644 +--- a/modules/mappers/mod_rewrite.c ++++ b/modules/mappers/mod_rewrite.c +@@ -168,6 +168,8 @@ static const char* really_last_key = "rewrite_really_last"; + #define RULEFLAG_END (1<<17) + #define RULEFLAG_ESCAPENOPLUS (1<<18) + #define RULEFLAG_QSLAST (1<<19) ++#define RULEFLAG_UNSAFE_PREFIX_STAT (1<<22) ++#define RULEFLAG_UNSAFE_ALLOW3F (1<<23) + + /* return code of the rewrite rule + * the result may be escaped - or not +@@ -175,7 +177,7 @@ static const char* really_last_key = "rewrite_really_last"; + #define ACTION_NORMAL (1<<0) + #define ACTION_NOESCAPE (1<<1) + #define ACTION_STATUS (1<<2) +- ++#define ACTION_STATUS_SET (1<<3) + + #define MAPTYPE_TXT (1<<0) + #define MAPTYPE_DBM (1<<1) +@@ -199,6 +201,7 @@ static const char* really_last_key = "rewrite_really_last"; + #define OPTION_IGNORE_INHERIT (1<<8) + #define OPTION_IGNORE_CONTEXT_INFO (1<<9) + #define OPTION_LEGACY_PREFIX_DOCROOT (1<<10) ++#define OPTION_UNSAFE_PREFIX_STAT (1<<12) + + #ifndef RAND_MAX + #define RAND_MAX 32767 +@@ -292,6 +295,14 @@ typedef enum { + CONDPAT_AP_EXPR + } pattern_type; + ++typedef enum { ++ RULE_RC_NOMATCH = 0, /* the rule didn't match */ ++ RULE_RC_MATCH = 1, /* a matching rule w/ substitution */ ++ RULE_RC_NOSUB = 2, /* a matching rule w/ no substitution */ ++ RULE_RC_STATUS_SET = 3 /* a matching rule that has set an HTTP error ++ to be returned in r->status */ ++} rule_return_type; ++ + typedef struct { + char *input; /* Input string of RewriteCond */ + char *pattern; /* the RegExp pattern string */ +@@ -929,10 +940,15 @@ static void fully_qualify_uri(request_rec *r) + return; + } + ++static int startsWith(request_rec *r, const char *haystack, const char *needle) { ++ int rc = (ap_strstr_c(haystack, needle) == haystack); ++ rewritelog((r, 5, NULL, "prefix_stat startsWith(%s, %s) %d", haystack, needle, rc)); ++ return rc; ++} + /* +- * stat() only the first segment of a path ++ * stat() only the first segment of a path, and only if it matches the output of the last matching rule + */ +-static int prefix_stat(const char *path, apr_pool_t *pool) ++static int prefix_stat(request_rec *r, const char *path, apr_pool_t *pool, rewriterule_entry *lastsub) + { + const char *curpath = path; + const char *root; +@@ -966,10 +982,36 @@ static int prefix_stat(const char *path, apr_pool_t *pool) + apr_finfo_t sb; + + if (apr_stat(&sb, statpath, APR_FINFO_MIN, pool) == APR_SUCCESS) { +- return 1; ++ if (!lastsub) { ++ rewritelog((r, 3, NULL, "prefix_stat no lastsub subst prefix %s", statpath)); ++ return 1; ++ } ++ ++ rewritelog((r, 3, NULL, "prefix_stat compare statpath %s and lastsub output %s STATOK %d ", ++ statpath, lastsub->output, lastsub->flags & RULEFLAG_UNSAFE_PREFIX_STAT)); ++ if (lastsub->flags & RULEFLAG_UNSAFE_PREFIX_STAT) { ++ return 1; ++ } ++ else { ++ const char *docroot = ap_document_root(r); ++ const char *context_docroot = ap_context_document_root(r); ++ /* ++ * As an example, path (r->filename) is /var/foo/bar/baz.html ++ * even if the flag is not set, we can accept a rule that ++ * began with a literal /var (stapath), or if the entire path ++ * starts with the docroot or context document root ++ */ ++ if (startsWith(r, lastsub->output, statpath) || ++ startsWith(r, path, docroot) || ++ ((docroot != context_docroot) && ++ startsWith(r, path, context_docroot))) { ++ return 1; ++ } ++ } + } + } + ++ /* prefix will be added */ + return 0; + } + +@@ -3042,6 +3084,9 @@ static const char *cmd_rewriteoptions(cmd_parms *cmd, + else if (!strcasecmp(w, "legacyprefixdocroot")) { + options |= OPTION_LEGACY_PREFIX_DOCROOT; + } ++ else if (!strcasecmp(w, "UnsafePrefixStat")) { ++ options |= OPTION_UNSAFE_PREFIX_STAT; ++ } + else { + return apr_pstrcat(cmd->pool, "RewriteOptions: unknown option '", + w, "'", NULL); +@@ -3739,6 +3784,18 @@ static const char *cmd_rewriterule_setflag(apr_pool_t *p, void *_cfg, + ++error; + } + break; ++ case 'u': ++ case 'U': ++ if (!strcasecmp(key, "nsafePrefixStat")){ ++ cfg->flags |= (RULEFLAG_UNSAFE_PREFIX_STAT); ++ } ++ else if(!strcasecmp(key, "nsafeAllow3F")) { ++ cfg->flags |= RULEFLAG_UNSAFE_ALLOW3F; ++ } ++ else { ++ ++error; ++ } ++ break; + default: + ++error; + break; +@@ -4076,7 +4133,8 @@ static APR_INLINE void force_type_handler(rewriterule_entry *p, + /* + * Apply a single RewriteRule + */ +-static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) ++static rule_return_type apply_rewrite_rule(rewriterule_entry *p, ++ rewrite_ctx *ctx) + { + ap_regmatch_t regmatch[AP_MAX_REG_MATCH]; + apr_array_header_t *rewriteconds; +@@ -4127,7 +4185,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + rc = !ap_regexec(p->regexp, ctx->uri, AP_MAX_REG_MATCH, regmatch, 0); + if (! (( rc && !(p->flags & RULEFLAG_NOTMATCH)) || + (!rc && (p->flags & RULEFLAG_NOTMATCH)) ) ) { +- return 0; ++ return RULE_RC_NOMATCH; + } + + /* It matched, wow! Now it's time to prepare the context structure for +@@ -4178,7 +4236,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + } + } + else if (!rc) { +- return 0; ++ return RULE_RC_NOMATCH; + } + + /* If some HTTP header was involved in the condition, remember it +@@ -4198,6 +4256,15 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + newuri = do_expand(p->output, ctx, p); + rewritelog((r, 2, ctx->perdir, "rewrite '%s' -> '%s'", ctx->uri, + newuri)); ++ if (!(p->flags & RULEFLAG_UNSAFE_ALLOW3F) && ++ ap_strcasestr(r->unparsed_uri, "%3f") && ++ ap_strchr_c(newuri, '?')) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO() ++ "Unsafe URL with %%3f URL rewritten without " ++ "UnsafeAllow3F"); ++ r->status = HTTP_FORBIDDEN; ++ return RULE_RC_STATUS_SET; ++ } + } + + /* expand [E=var:val] and [CO=] */ +@@ -4215,7 +4282,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + r->status = p->forced_responsecode; + } + +- return 2; ++ return RULE_RC_NOSUB; + } + + /* Add the previously stripped per-directory location prefix, unless +@@ -4285,7 +4352,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + r->filename)); + + r->filename = apr_pstrcat(r->pool, "proxy:", r->filename, NULL); +- return 1; ++ return RULE_RC_MATCH; + } + + /* If this rule is explicitly forced for HTTP redirection +@@ -4300,7 +4367,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + r->filename)); + + r->status = p->forced_responsecode; +- return 1; ++ return RULE_RC_MATCH; + } + + /* Special Rewriting Feature: Self-Reduction +@@ -4322,7 +4389,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + "with %s", p->forced_responsecode, r->filename)); + + r->status = p->forced_responsecode; +- return 1; ++ return RULE_RC_MATCH; + } + + /* Finally remember the forced mime-type */ +@@ -4331,7 +4398,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + /* Puuhhhhhhhh... WHAT COMPLICATED STUFF ;_) + * But now we're done for this particular rule. + */ +- return 1; ++ return RULE_RC_MATCH; + } + + /* +@@ -4339,13 +4406,13 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + * i.e. a list of rewrite rules + */ + static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules, +- char *perdir) ++ char *perdir, rewriterule_entry **lastsub) + { + rewriterule_entry *entries; + rewriterule_entry *p; + int i; + int changed; +- int rc; ++ rule_return_type rc; + int s; + rewrite_ctx *ctx; + int round = 1; +@@ -4353,6 +4420,7 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules, + ctx = apr_palloc(r->pool, sizeof(*ctx)); + ctx->perdir = perdir; + ctx->r = r; ++ *lastsub = NULL; + + /* + * Iterate over all existing rules +@@ -4380,7 +4448,12 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules, + ctx->vary = NULL; + rc = apply_rewrite_rule(p, ctx); + +- if (rc) { ++ if (rc != RULE_RC_NOMATCH) { ++ ++ if (!(p->flags & RULEFLAG_NOSUB)) { ++ rewritelog((r, 2, perdir, "setting lastsub to rule with output %s", p->output)); ++ *lastsub = p; ++ } + + /* Catch looping rules with pathinfo growing unbounded */ + if ( strlen( r->filename ) > 2*r->server->limit_req_line ) { +@@ -4400,6 +4473,12 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules, + apr_table_merge(r->headers_out, "Vary", ctx->vary); + } + ++ ++ /* Error while evaluating rule, r->status set */ ++ if (RULE_RC_STATUS_SET == rc) { ++ return ACTION_STATUS_SET; ++ } ++ + /* + * The rule sets the response code (implies match-only) + */ +@@ -4410,7 +4489,7 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules, + /* + * Indicate a change if this was not a match-only rule. + */ +- if (rc != 2) { ++ if (rc != RULE_RC_NOSUB) { + changed = ((p->flags & RULEFLAG_NOESCAPE) + ? ACTION_NOESCAPE : ACTION_NORMAL); + } +@@ -4602,6 +4681,7 @@ static int hook_uri2file(request_rec *r) + int rulestatus; + void *skipdata; + const char *oargs; ++ rewriterule_entry *lastsub = NULL; + + /* + * retrieve the config structures +@@ -4713,7 +4793,7 @@ static int hook_uri2file(request_rec *r) + /* + * now apply the rules ... + */ +- rulestatus = apply_rewrite_list(r, conf->rewriterules, NULL); ++ rulestatus = apply_rewrite_list(r, conf->rewriterules, NULL, &lastsub); + apr_table_setn(r->notes, "mod_rewrite_rewritten", + apr_psprintf(r->pool,"%d",rulestatus)); + } +@@ -4745,6 +4825,9 @@ static int hook_uri2file(request_rec *r) + r->status = HTTP_OK; + return n; + } ++ else if (ACTION_STATUS_SET == rulestatus) { ++ return r->status; ++ } + + flen = r->filename ? strlen(r->filename) : 0; + if (flen > 6 && strncmp(r->filename, "proxy:", 6) == 0) { +@@ -4865,23 +4948,29 @@ static int hook_uri2file(request_rec *r) + return HTTP_BAD_REQUEST; + } + +- /* if there is no valid prefix, we call +- * the translator from the core and +- * prefix the filename with document_root ++ /* We have r->filename as a path in a server-context rewrite without ++ * the PT flag. The historical behavior is to treat it as a verbatim ++ * filesystem path iff the first component of the path exists and is ++ * readable by httpd. Otherwise, it is interpreted as DocumentRoot ++ * relative. + * + * NOTICE: + * We cannot leave out the prefix_stat because +- * - when we always prefix with document_root +- * then no absolute path can be created, e.g. via +- * emulating a ScriptAlias directive, etc. +- * - when we always NOT prefix with document_root ++ * - If we always prefix with document_root ++ * then no absolute path can could ever be used in ++ * a substitution. e.g. emulating an Alias. ++ * - If we never prefix with document_root + * then the files under document_root have to + * be references directly and document_root + * gets never used and will be a dummy parameter - +- * this is also bad ++ * this is also bad. ++ * - Later addition: This part is questionable. ++ * If we had never prefixed, users would just ++ * need %{DOCUMENT_ROOT} in substitutions or the ++ * [PT] flag. + * + * BUT: +- * Under real Unix systems this is no problem, ++ * Under real Unix systems this is no perf problem, + * because we only do stat() on the first directory + * and this gets cached by the kernel for along time! + */ +@@ -4890,7 +4979,9 @@ static int hook_uri2file(request_rec *r) + uri_reduced = apr_table_get(r->notes, "mod_rewrite_uri_reduced"); + } + +- if (!prefix_stat(r->filename, r->pool) || uri_reduced != NULL) { ++ if (!prefix_stat(r, r->filename, r->pool, ++ conf->options & OPTION_UNSAFE_PREFIX_STAT ? NULL : lastsub) ++ || uri_reduced != NULL) { + int res; + char *tmp = r->uri; + +@@ -4935,6 +5026,7 @@ static int hook_fixup(request_rec *r) + char *ofilename, *oargs; + int is_proxyreq; + void *skipdata; ++ rewriterule_entry *lastsub; + + dconf = (rewrite_perdir_conf *)ap_get_module_config(r->per_dir_config, + &rewrite_module); +@@ -5019,7 +5111,7 @@ static int hook_fixup(request_rec *r) + /* + * now apply the rules ... + */ +- rulestatus = apply_rewrite_list(r, dconf->rewriterules, dconf->directory); ++ rulestatus = apply_rewrite_list(r, dconf->rewriterules, dconf->directory, &lastsub); + if (rulestatus) { + unsigned skip; + +@@ -5040,6 +5132,9 @@ static int hook_fixup(request_rec *r) + r->status = HTTP_OK; + return n; + } ++ else if (ACTION_STATUS_SET == rulestatus) { ++ return r->status; ++ } + + l = strlen(r->filename); + if (l > 6 && strncmp(r->filename, "proxy:", 6) == 0) { +-- +2.33.0 + diff --git a/backport-CVE-2024-38476-add-ap_set_content_type_ex-to-differentiate-trusted-sources.patch b/backport-CVE-2024-38476-add-ap_set_content_type_ex-to-differentiate-trusted-sources.patch new file mode 100644 index 0000000000000000000000000000000000000000..602a31ac24730f46aa9c7a7be2f327af12efe489 --- /dev/null +++ b/backport-CVE-2024-38476-add-ap_set_content_type_ex-to-differentiate-trusted-sources.patch @@ -0,0 +1,364 @@ +From 554554b0ebb14d6578adb70a389c57a0d5f18a3b Mon Sep 17 00:00:00 2001 +From: Eric Covener +Date: Mon, 24 Jun 2024 17:54:34 +0000 +Subject: [PATCH] Merge r1918551 from trunk: + +add ap_set_content_type_ex to differentiate + +trusted sources + + + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918560 13f79535-47bb-0310-9956-ffa450edef68 + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/554554b0ebb14d6578adb70a389c57a0d5f18a3b + +--- + include/http_protocol.h | 11 +++++++ + include/httpd.h | 54 +++++++++++++++++++++++++++++++ + modules/http/http_protocol.c | 6 ++++ + modules/http/mod_mime.c | 20 ++++++------ + modules/mappers/mod_actions.c | 6 ++-- + modules/mappers/mod_negotiation.c | 8 ++--- + modules/mappers/mod_rewrite.c | 2 +- + modules/metadata/mod_headers.c | 6 ++-- + modules/metadata/mod_mime_magic.c | 4 +-- + server/config.c | 2 +- + server/core.c | 2 +- + 11 files changed, 97 insertions(+), 24 deletions(-) + +diff --git a/include/http_protocol.h b/include/http_protocol.h +index 0468d75..a1bb1a3 100644 +--- a/include/http_protocol.h ++++ b/include/http_protocol.h +@@ -381,6 +381,17 @@ AP_DECLARE(void) ap_clear_method_list(ap_method_list_t *l); + */ + AP_DECLARE(void) ap_set_content_type(request_rec *r, const char *ct); + ++/** ++ * Set the content type for this request (r->content_type). ++ * @param r The current request ++ * @param ct The new content type ++ * @param trusted If non-zero, The content-type should come from a ++ * trusted source such as server configuration rather ++ * than application output. ++ * for the AddOutputFilterByType directive to work correctly. ++ */ ++AP_DECLARE(void) ap_set_content_type_ex(request_rec *r, const char *ct, int trusted); ++ + /** + * Set the Accept-Ranges header for this response + * @param r The current request +diff --git a/include/httpd.h b/include/httpd.h +index acb4c5f..67197d7 100644 +--- a/include/httpd.h ++++ b/include/httpd.h +@@ -645,6 +645,49 @@ struct ap_method_list_t { + /** the array used for extension methods */ + apr_array_header_t *method_list; + }; ++/** @} */ ++ ++/** ++ * @defgroup bnotes Binary notes recognized by the server ++ * @ingroup APACHE_CORE_DAEMON ++ * @{ ++ * ++ * @brief Binary notes recognized by the server. ++ */ ++ ++/** ++ * The type used for request binary notes. ++ */ ++typedef apr_uint64_t ap_request_bnotes_t; ++ ++/** ++ * These constants represent bitmasks for notes associated with this ++ * request. There are space for 64 bits in the apr_uint64_t. ++ * ++ */ ++#define AP_REQUEST_STRONG_ETAG 1 >> 0 ++#define AP_REQUEST_TRUSTED_CT 1 << 1 ++ ++/** ++ * This is a convenience macro to ease with getting specific request ++ * binary notes. ++ */ ++#define AP_REQUEST_GET_BNOTE(r, mask) \ ++ ((mask) & ((r)->bnotes)) ++ ++/** ++ * This is a convenience macro to ease with setting specific request ++ * binary notes. ++ */ ++#define AP_REQUEST_SET_BNOTE(r, mask, val) \ ++ (r)->bnotes = (((r)->bnotes & ~(mask)) | (val)) ++ ++/** ++ * Returns true if the strong etag flag is set for this request. ++ */ ++#define AP_REQUEST_IS_STRONG_ETAG(r) \ ++ AP_REQUEST_GET_BNOTE((r), AP_REQUEST_STRONG_ETAG) ++/** @} */ + + /** + * @defgroup module_magic Module Magic mime types +@@ -715,6 +758,12 @@ struct ap_method_list_t { + + /** @} // values_request_rec_used_path_info */ + ++/** ++ * Returns true if the content-type field is from a trusted source ++ */ ++#define AP_REQUEST_IS_TRUSTED_CT(r) \ ++ (!!AP_REQUEST_GET_BNOTE((r), AP_REQUEST_TRUSTED_CT)) ++/** @} */ + + /* + * Things which may vary per file-lookup WITHIN a request --- +@@ -1062,6 +1111,11 @@ struct request_rec { + * 1 yes/success + */ + int double_reverse; ++ /** Request flags associated with this request. Use ++ * AP_REQUEST_GET_FLAGS() and AP_REQUEST_SET_FLAGS() to access ++ * the elements of this field. ++ */ ++ ap_request_bnotes_t bnotes; + }; + + /** +diff --git a/modules/http/http_protocol.c b/modules/http/http_protocol.c +index 6e0301a..c22c90b 100644 +--- a/modules/http/http_protocol.c ++++ b/modules/http/http_protocol.c +@@ -1076,8 +1076,14 @@ AP_DECLARE(void) ap_set_content_type(request_rec *r, const char *ct) + } + else if (!r->content_type || strcmp(r->content_type, ct)) { + r->content_type = ct; ++ AP_REQUEST_SET_BNOTE(r, AP_REQUEST_TRUSTED_CT, 0); + } + } ++AP_DECLARE(void) ap_set_content_type_ex(request_rec *r, const char *ct, int trusted) ++{ ++ ap_set_content_type(r, ct); ++ AP_REQUEST_SET_BNOTE(r, AP_REQUEST_TRUSTED_CT, trusted ? AP_REQUEST_TRUSTED_CT : 0); ++} + + AP_DECLARE(void) ap_set_accept_ranges(request_rec *r) + { +diff --git a/modules/http/mod_mime.c b/modules/http/mod_mime.c +index 03d1c41..1bf531d 100644 +--- a/modules/http/mod_mime.c ++++ b/modules/http/mod_mime.c +@@ -759,7 +759,7 @@ static int find_ct(request_rec *r) + int found_metadata = 0; + + if (r->finfo.filetype == APR_DIR) { +- ap_set_content_type(r, DIR_MAGIC_TYPE); ++ ap_set_content_type_ex(r, DIR_MAGIC_TYPE, 1); + return OK; + } + +@@ -837,7 +837,7 @@ static int find_ct(request_rec *r) + if (exinfo == NULL || !exinfo->forced_type) { + if ((type = apr_hash_get(mime_type_extensions, ext, + APR_HASH_KEY_STRING)) != NULL) { +- ap_set_content_type(r, (char*) type); ++ ap_set_content_type_ex(r, (char*) type, 1); + found = 1; + } + } +@@ -846,7 +846,7 @@ static int find_ct(request_rec *r) + + /* empty string is treated as special case for RemoveType */ + if (exinfo->forced_type && *exinfo->forced_type) { +- ap_set_content_type(r, exinfo->forced_type); ++ ap_set_content_type_ex(r, exinfo->forced_type, 1); + found = 1; + } + +@@ -951,33 +951,33 @@ static int find_ct(request_rec *r) + memcpy(tmp, ctp->subtype, ctp->subtype_len); + tmp += ctp->subtype_len; + *tmp = 0; +- ap_set_content_type(r, base_content_type); ++ ap_set_content_type_ex(r, base_content_type, AP_REQUEST_IS_TRUSTED_CT(r)); + while (pp != NULL) { + if (charset && !strcmp(pp->attr, "charset")) { + if (!override) { +- ap_set_content_type(r, ++ ap_set_content_type_ex(r, + apr_pstrcat(r->pool, + r->content_type, + "; charset=", + charset, +- NULL)); ++ NULL), AP_REQUEST_IS_TRUSTED_CT(r)); + override = 1; + } + } + else { +- ap_set_content_type(r, ++ ap_set_content_type_ex(r, + apr_pstrcat(r->pool, + r->content_type, + "; ", pp->attr, + "=", pp->val, +- NULL)); ++ NULL), AP_REQUEST_IS_TRUSTED_CT(r)); + } + pp = pp->next; + } + if (charset && !override) { +- ap_set_content_type(r, apr_pstrcat(r->pool, r->content_type, ++ ap_set_content_type_ex(r, apr_pstrcat(r->pool, r->content_type, + "; charset=", charset, +- NULL)); ++ NULL), AP_REQUEST_IS_TRUSTED_CT(r)); + } + } + } +diff --git a/modules/mappers/mod_actions.c b/modules/mappers/mod_actions.c +index ac9c3b7..5e398b5 100644 +--- a/modules/mappers/mod_actions.c ++++ b/modules/mappers/mod_actions.c +@@ -182,8 +182,10 @@ static int action_handler(request_rec *r) + return DECLINED; + + /* Second, check for actions (which override the method scripts) */ +- action = r->handler ? r->handler : +- ap_field_noparam(r->pool, r->content_type); ++ action = r->handler; ++ if (!action && AP_REQUEST_IS_TRUSTED_CT(r)) { ++ action = ap_field_noparam(r->pool, r->content_type); ++ } + + if (action && (t = apr_table_get(conf->action_types, action))) { + int virtual = (*t++ == '0' ? 0 : 1); +diff --git a/modules/mappers/mod_negotiation.c b/modules/mappers/mod_negotiation.c +index b6dfedc..eab08e0 100644 +--- a/modules/mappers/mod_negotiation.c ++++ b/modules/mappers/mod_negotiation.c +@@ -1169,7 +1169,7 @@ static int read_types_multi(negotiation_state *neg) + * might be doing. + */ + if (sub_req->handler && !sub_req->content_type) { +- ap_set_content_type(sub_req, CGI_MAGIC_TYPE); ++ ap_set_content_type_ex(sub_req, CGI_MAGIC_TYPE, 1); + } + + /* +@@ -3005,14 +3005,14 @@ static int handle_map_file(request_rec *r) + /* set MIME type and charset as negotiated */ + if (best->mime_type && *best->mime_type) { + if (best->content_charset && *best->content_charset) { +- ap_set_content_type(r, apr_pstrcat(r->pool, ++ ap_set_content_type_ex(r, apr_pstrcat(r->pool, + best->mime_type, + "; charset=", + best->content_charset, +- NULL)); ++ NULL), 1); + } + else { +- ap_set_content_type(r, apr_pstrdup(r->pool, best->mime_type)); ++ ap_set_content_type_ex(r, apr_pstrdup(r->pool, best->mime_type), 1); + } + } + +diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c +index 10a215e..3603150 100644 +--- a/modules/mappers/mod_rewrite.c ++++ b/modules/mappers/mod_rewrite.c +@@ -5375,7 +5375,7 @@ static int hook_mimetype(request_rec *r) + rewritelog((r, 1, NULL, "force filename %s to have MIME-type '%s'", + r->filename, t)); + +- ap_set_content_type(r, t); ++ ap_set_content_type_ex(r, t, 1); + } + + /* handler */ +diff --git a/modules/metadata/mod_headers.c b/modules/metadata/mod_headers.c +index 82d0045..be8fbb2 100644 +--- a/modules/metadata/mod_headers.c ++++ b/modules/metadata/mod_headers.c +@@ -792,14 +792,14 @@ static int do_headers_fixup(request_rec *r, apr_table_t *headers, + break; + case hdr_set: + if (!strcasecmp(hdr->header, "Content-Type")) { +- ap_set_content_type(r, process_tags(hdr, r)); ++ ap_set_content_type_ex(r, process_tags(hdr, r), 1); + } + apr_table_setn(headers, hdr->header, process_tags(hdr, r)); + break; + case hdr_setifempty: + if (NULL == apr_table_get(headers, hdr->header)) { + if (!strcasecmp(hdr->header, "Content-Type")) { +- ap_set_content_type(r, process_tags(hdr, r)); ++ ap_set_content_type_ex(r, process_tags(hdr, r), 1); + } + apr_table_setn(headers, hdr->header, process_tags(hdr, r)); + } +@@ -818,7 +818,7 @@ static int do_headers_fixup(request_rec *r, apr_table_t *headers, + const char *repl = process_regexp(hdr, r->content_type, r); + if (repl == NULL) + return 0; +- ap_set_content_type(r, repl); ++ ap_set_content_type_ex(r, repl, 1); + } + if (apr_table_get(headers, hdr->header)) { + edit_do ed; +diff --git a/modules/metadata/mod_mime_magic.c b/modules/metadata/mod_mime_magic.c +index 3ecb3c0..b828c2f 100644 +--- a/modules/metadata/mod_mime_magic.c ++++ b/modules/metadata/mod_mime_magic.c +@@ -788,7 +788,7 @@ static int magic_rsl_to_request(request_rec *r) + /* XXX: this could be done at config time I'm sure... but I'm + * confused by all this magic_rsl stuff. -djg */ + ap_content_type_tolower(tmp); +- ap_set_content_type(r, tmp); ++ ap_set_content_type_ex(r, tmp, 1); + + if (state == rsl_encoding) { + tmp = rsl_strdup(r, encoding_frag, +@@ -2325,7 +2325,7 @@ static int revision_suffix(request_rec *r) + + /* extract content type/encoding/language from sub-request */ + if (sub->content_type) { +- ap_set_content_type(r, apr_pstrdup(r->pool, sub->content_type)); ++ ap_set_content_type_ex(r, apr_pstrdup(r->pool, sub->content_type), 1); + #if MIME_MAGIC_DEBUG + ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(01557) + MODNAME ": subrequest %s got %s", +diff --git a/server/config.c b/server/config.c +index 0380cbe..bc8ec54 100644 +--- a/server/config.c ++++ b/server/config.c +@@ -419,7 +419,7 @@ AP_CORE_DECLARE(int) ap_invoke_handler(request_rec *r) + } + + if (!r->handler) { +- if (r->content_type) { ++ if (r->content_type && AP_REQUEST_IS_TRUSTED_CT(r)) { + handler = r->content_type; + if ((p=ap_strchr_c(handler, ';')) != NULL) { + char *new_handler = (char *)apr_pmemdup(r->pool, handler, +diff --git a/server/core.c b/server/core.c +index c6e032c..edd3c0f 100644 +--- a/server/core.c ++++ b/server/core.c +@@ -4775,7 +4775,7 @@ static int core_override_type(request_rec *r) + /* Check for overrides with ForceType / SetHandler + */ + if (conf->mime_type && strcmp(conf->mime_type, "none")) +- ap_set_content_type(r, (char*) conf->mime_type); ++ ap_set_content_type_ex(r, (char*) conf->mime_type, 1); + + if (conf->expr_handler) { + const char *err; +-- +2.27.0 + diff --git a/backport-CVE-2024-38477-validate-hostsname.patch b/backport-CVE-2024-38477-validate-hostsname.patch new file mode 100644 index 0000000000000000000000000000000000000000..2f06117e150817aa0d4fc5d7d9375ed3bb6d605d --- /dev/null +++ b/backport-CVE-2024-38477-validate-hostsname.patch @@ -0,0 +1,50 @@ +From 1d98d4db186e708f059336fb9342d0adb6925e85 Mon Sep 17 00:00:00 2001 +From: Eric Covener +Date: Tue, 25 Jun 2024 17:29:32 +0000 +Subject: [PATCH] Merge r1918606 from trunk: + +validate hostname + + + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918607 13f79535-47bb-0310-9956-ffa450edef68 + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/1d98d4db186e708f059336fb9342d0adb6925e85 + +--- + modules/proxy/proxy_util.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c +index 79e12fc..a9c21ad 100644 +--- a/modules/proxy/proxy_util.c ++++ b/modules/proxy/proxy_util.c +@@ -2427,6 +2427,13 @@ ap_proxy_determine_connection(apr_pool_t *p, request_rec *r, + apr_pstrcat(p,"URI cannot be parsed: ", *url, + NULL)); + } ++ ++ if (!uri->hostname) { ++ return ap_proxyerror(r, HTTP_BAD_REQUEST, ++ apr_pstrcat(p,"URI has no hostname: ", *url, ++ NULL)); ++ } ++ + if (!uri->port) { + uri->port = ap_proxy_port_of_scheme(uri->scheme); + } +@@ -3749,6 +3756,10 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p, + * way. No telling which legacy backend is relying no this. + */ + if (dconf->preserve_host == 0) { ++ if (!uri->hostname) { ++ rc = HTTP_BAD_REQUEST; ++ goto cleanup; ++ } + if (ap_strchr_c(uri->hostname, ':')) { /* if literal IPv6 address */ + if (uri->port_str && uri->port != DEFAULT_HTTP_PORT) { + buf = apr_pstrcat(p, "Host: [", uri->hostname, "]:", +-- +2.33.0 + diff --git a/backport-CVE-2024-39884-maintain-trusted-flag.patch b/backport-CVE-2024-39884-maintain-trusted-flag.patch new file mode 100644 index 0000000000000000000000000000000000000000..8c2c39c1485e27a3f6dd208863eff4e0dc8091cd --- /dev/null +++ b/backport-CVE-2024-39884-maintain-trusted-flag.patch @@ -0,0 +1,309 @@ +From fe171ffdf85cdfc3f6f44e8dd0ee3d5e3e6a0d1d Mon Sep 17 00:00:00 2001 +From: Eric Covener +Date: Tue, 2 Jul 2024 13:07:17 +0000 +Subject: [PATCH] Merge r1918795, r1918814 from trunk: + +maintain trusted flag + + +* Always trust content types that we set literally + +Submitted by: covener, rpluem +Reviewed by: covener, jorton, rpluem + +Github: closes #459 + + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918839 13f79535-47bb-0310-9956-ffa450edef68 + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/fe171ffdf85cdfc3f6f44e8dd0ee3d5e3e6a0d1d + +--- + modules/cluster/mod_heartmonitor.c | 2 +- + modules/dav/main/mod_dav.c | 10 +++++----- + modules/examples/mod_example_hooks.c | 2 +- + modules/filters/mod_data.c | 2 +- + modules/filters/mod_include.c | 2 +- + modules/filters/mod_proxy_html.c | 4 ++-- + modules/generators/mod_cgi.c | 2 +- + modules/generators/mod_cgid.c | 2 +- + modules/generators/mod_info.c | 2 +- + modules/generators/mod_status.c | 4 ++-- + modules/http/http_filters.c | 2 +- + modules/http/http_protocol.c | 4 ++-- + modules/http/http_request.c | 2 +- + modules/ldap/util_ldap.c | 2 +- + modules/mappers/mod_imagemap.c | 2 +- + modules/proxy/mod_proxy_balancer.c | 2 +- + 16 files changed, 23 insertions(+), 23 deletions(-) + +diff --git a/modules/cluster/mod_heartmonitor.c b/modules/cluster/mod_heartmonitor.c +index 61a8517..283981d 100644 +--- a/modules/cluster/mod_heartmonitor.c ++++ b/modules/cluster/mod_heartmonitor.c +@@ -780,7 +780,7 @@ static int hm_handler(request_rec *r) + hmserver.seen = apr_time_now(); + hm_update_stat(ctx, &hmserver, r->pool); + +- ap_set_content_type(r, "text/plain"); ++ ap_set_content_type_ex(r, "text/plain", 1); + ap_set_content_length(r, 2); + ap_rputs("OK", r); + ap_rflush(r); +diff --git a/modules/dav/main/mod_dav.c b/modules/dav/main/mod_dav.c +index eb8af77..0ebc515 100644 +--- a/modules/dav/main/mod_dav.c ++++ b/modules/dav/main/mod_dav.c +@@ -323,7 +323,7 @@ static int dav_error_response(request_rec *r, int status, const char *body) + r->status = status; + r->status_line = ap_get_status_line(status); + +- ap_set_content_type(r, "text/html; charset=ISO-8859-1"); ++ ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1); + + /* begin the response now... */ + ap_rvputs(r, +@@ -354,7 +354,7 @@ static int dav_error_response_tag(request_rec *r, + { + r->status = err->status; + +- ap_set_content_type(r, DAV_XML_CONTENT_TYPE); ++ ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1); + + ap_rputs(DAV_XML_HEADER DEBUG_CR + "status = status; +- ap_set_content_type(r, DAV_XML_CONTENT_TYPE); ++ ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1); + + /* Send the headers and actual multistatus response now... */ + ap_fputs(r->output_filters, bb, DAV_XML_HEADER DEBUG_CR +@@ -1923,7 +1923,7 @@ static int dav_method_options(request_rec *r) + + /* send the options response */ + r->status = HTTP_OK; +- ap_set_content_type(r, DAV_XML_CONTENT_TYPE); ++ ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1); + + /* send the headers and response body */ + ap_rputs(DAV_XML_HEADER DEBUG_CR +@@ -3192,7 +3192,7 @@ static int dav_method_lock(request_rec *r) + (*locks_hooks->close_lockdb)(lockdb); + + r->status = HTTP_OK; +- ap_set_content_type(r, DAV_XML_CONTENT_TYPE); ++ ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1); + + ap_rputs(DAV_XML_HEADER DEBUG_CR "" DEBUG_CR, r); + if (lock == NULL) +diff --git a/modules/examples/mod_example_hooks.c b/modules/examples/mod_example_hooks.c +index d818dc1..4d79b86 100644 +--- a/modules/examples/mod_example_hooks.c ++++ b/modules/examples/mod_example_hooks.c +@@ -993,7 +993,7 @@ static int x_handler(request_rec *r) + * Set the Content-type header. Note that we do not actually have to send + * the headers: this is done by the http core. + */ +- ap_set_content_type(r, "text/html"); ++ ap_set_content_type_ex(r, "text/html", 1); + /* + * If we're only supposed to send header information (HEAD request), we're + * already there. +diff --git a/modules/filters/mod_data.c b/modules/filters/mod_data.c +index d083d32..489e76c 100644 +--- a/modules/filters/mod_data.c ++++ b/modules/filters/mod_data.c +@@ -117,7 +117,7 @@ static apr_status_t data_out_filter(ap_filter_t *f, apr_bucket_brigade *bb) + } + } + +- ap_set_content_type(r, "text/plain"); ++ ap_set_content_type_ex(r, "text/plain", 1); + + } + +diff --git a/modules/filters/mod_include.c b/modules/filters/mod_include.c +index a46a944..05f994c 100644 +--- a/modules/filters/mod_include.c ++++ b/modules/filters/mod_include.c +@@ -3971,7 +3971,7 @@ static int include_fixup(request_rec *r) + if (r->handler && (strcmp(r->handler, "server-parsed") == 0)) + { + if (!r->content_type || !*r->content_type) { +- ap_set_content_type(r, "text/html"); ++ ap_set_content_type_ex(r, "text/html", 1); + } + r->handler = "default-handler"; + } +diff --git a/modules/filters/mod_proxy_html.c b/modules/filters/mod_proxy_html.c +index 25eb395..ce45878 100644 +--- a/modules/filters/mod_proxy_html.c ++++ b/modules/filters/mod_proxy_html.c +@@ -952,7 +952,7 @@ static apr_status_t proxy_html_filter(ap_filter_t *f, apr_bucket_brigade *bb) + ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, f->r, APLOGNO(01422) + "No i18n support found. Install mod_xml2enc if required"); + enc = XML_CHAR_ENCODING_NONE; +- ap_set_content_type(f->r, "text/html;charset=utf-8"); ++ ap_set_content_type_ex(f->r, "text/html;charset=utf-8", 1); + } + else { + /* if we wanted a non-default charset_out, insert the +@@ -968,7 +968,7 @@ static apr_status_t proxy_html_filter(ap_filter_t *f, apr_bucket_brigade *bb) + cenc, NULL)); + } + else /* Normal case, everything worked, utf-8 output */ +- ap_set_content_type(f->r, "text/html;charset=utf-8"); ++ ap_set_content_type_ex(f->r, "text/html;charset=utf-8", 1); + } + + ap_fputs(f->next, ctxt->bb, ctxt->cfg->doctype); +diff --git a/modules/generators/mod_cgi.c b/modules/generators/mod_cgi.c +index 96bb883..9537cc5 100644 +--- a/modules/generators/mod_cgi.c ++++ b/modules/generators/mod_cgi.c +@@ -1080,7 +1080,7 @@ static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f, + /* Force sub_req to be treated as a CGI request, even if ordinary + * typing rules would have called it something else. + */ +- ap_set_content_type(rr, CGI_MAGIC_TYPE); ++ ap_set_content_type_ex(rr, CGI_MAGIC_TYPE, 1); + + /* Run it. */ + rr_status = ap_run_sub_req(rr); +diff --git a/modules/generators/mod_cgid.c b/modules/generators/mod_cgid.c +index 1a67779..43ee691 100644 +--- a/modules/generators/mod_cgid.c ++++ b/modules/generators/mod_cgid.c +@@ -1758,7 +1758,7 @@ static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f, + /* Force sub_req to be treated as a CGI request, even if ordinary + * typing rules would have called it something else. + */ +- ap_set_content_type(rr, CGI_MAGIC_TYPE); ++ ap_set_content_type_ex(rr, CGI_MAGIC_TYPE, 1); + + /* Run it. */ + rr_status = ap_run_sub_req(rr); +diff --git a/modules/generators/mod_info.c b/modules/generators/mod_info.c +index e7af783..78106cd 100644 +--- a/modules/generators/mod_info.c ++++ b/modules/generators/mod_info.c +@@ -777,7 +777,7 @@ static int display_info(request_rec * r) + return DECLINED; + } + +- ap_set_content_type(r, "text/html; charset=ISO-8859-1"); ++ ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1); + + ap_rputs(DOCTYPE_XHTML_1_0T + "\n" +diff --git a/modules/generators/mod_status.c b/modules/generators/mod_status.c +index 5917953..b1d82cb 100644 +--- a/modules/generators/mod_status.c ++++ b/modules/generators/mod_status.c +@@ -269,7 +269,7 @@ static int status_handler(request_rec *r) + if (r->method_number != M_GET) + return DECLINED; + +- ap_set_content_type(r, "text/html; charset=ISO-8859-1"); ++ ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1); + + /* + * Simple table-driven form data set parser that lets you alter the header +@@ -297,7 +297,7 @@ static int status_handler(request_rec *r) + no_table_report = 1; + break; + case STAT_OPT_AUTO: +- ap_set_content_type(r, "text/plain; charset=ISO-8859-1"); ++ ap_set_content_type_ex(r, "text/plain; charset=ISO-8859-1", 1); + short_report = 1; + break; + } +diff --git a/modules/http/http_filters.c b/modules/http/http_filters.c +index 4073fc9..fd29a24 100644 +--- a/modules/http/http_filters.c ++++ b/modules/http/http_filters.c +@@ -1256,7 +1256,7 @@ AP_DECLARE_NONSTD(int) ap_send_http_trace(request_rec *r) + } + } + +- ap_set_content_type(r, "message/http"); ++ ap_set_content_type_ex(r, "message/http", 1); + + /* Now we recreate the request, and echo it back */ + +diff --git a/modules/http/http_protocol.c b/modules/http/http_protocol.c +index c22c90b..dc17608 100644 +--- a/modules/http/http_protocol.c ++++ b/modules/http/http_protocol.c +@@ -1422,10 +1422,10 @@ AP_DECLARE(void) ap_send_error_response(request_rec *r, int recursive_error) + request_conf->suppress_charset = 1; /* avoid adding default + * charset later + */ +- ap_set_content_type(r, "text/html"); ++ ap_set_content_type_ex(r, "text/html", 1); + } + else { +- ap_set_content_type(r, "text/html; charset=iso-8859-1"); ++ ap_set_content_type_ex(r, "text/html; charset=iso-8859-1", 1); + } + + if ((status == HTTP_METHOD_NOT_ALLOWED) +diff --git a/modules/http/http_request.c b/modules/http/http_request.c +index d59cfe2..71ecc2b 100644 +--- a/modules/http/http_request.c ++++ b/modules/http/http_request.c +@@ -708,7 +708,7 @@ AP_DECLARE(void) ap_internal_fast_redirect(request_rec *rr, request_rec *r) + r->args = rr->args; + r->finfo = rr->finfo; + r->handler = rr->handler; +- ap_set_content_type(r, rr->content_type); ++ ap_set_content_type_ex(r, rr->content_type, AP_REQUEST_IS_TRUSTED_CT(r)); + r->content_encoding = rr->content_encoding; + r->content_languages = rr->content_languages; + r->per_dir_config = rr->per_dir_config; +diff --git a/modules/ldap/util_ldap.c b/modules/ldap/util_ldap.c +index 16bcc3d..0c0414f 100644 +--- a/modules/ldap/util_ldap.c ++++ b/modules/ldap/util_ldap.c +@@ -125,7 +125,7 @@ static int util_ldap_handler(request_rec *r) + st = (util_ldap_state_t *) ap_get_module_config(r->server->module_config, + &ldap_module); + +- ap_set_content_type(r, "text/html; charset=ISO-8859-1"); ++ ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1); + + if (r->header_only) + return OK; +diff --git a/modules/mappers/mod_imagemap.c b/modules/mappers/mod_imagemap.c +index 187a500..3e14933 100644 +--- a/modules/mappers/mod_imagemap.c ++++ b/modules/mappers/mod_imagemap.c +@@ -475,7 +475,7 @@ static int imap_reply(request_rec *r, const char *redirect) + + static void menu_header(request_rec *r, char *menu) + { +- ap_set_content_type(r, "text/html; charset=ISO-8859-1"); ++ ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1); + + ap_rvputs(r, DOCTYPE_HTML_3_2, "\nMenu for ", + ap_escape_html(r->pool, r->uri), +diff --git a/modules/proxy/mod_proxy_balancer.c b/modules/proxy/mod_proxy_balancer.c +index f235f4a..67aa081 100644 +--- a/modules/proxy/mod_proxy_balancer.c ++++ b/modules/proxy/mod_proxy_balancer.c +@@ -1506,7 +1506,7 @@ static int balancer_handler(request_rec *r) + + if (apr_table_get(params, "xml")) { + char date[APR_RFC822_DATE_LEN]; +- ap_set_content_type(r, "text/xml"); ++ ap_set_content_type_ex(r, "text/xml", 1); + ap_rputs("<?xml version='1.0' encoding='UTF-8' ?>\n", r); + ap_rputs("<httpd:manager xmlns:httpd='http://httpd.apache.org'>\n", r); + ap_rputs(" <httpd:balancers>\n", r); +-- +2.33.0 + diff --git a/httpd.spec b/httpd.spec index d2427de6e8a57d69216d1534b90133967f65743a..b1cb8495e127ba0a754b8a012fc638c0c65f3913 100644 --- a/httpd.spec +++ b/httpd.spec @@ -8,7 +8,7 @@ Name: httpd Summary: Apache HTTP Server Version: 2.4.43 -Release: 24 +Release: 25 License: ASL 2.0 URL: https://httpd.apache.org/ Source0: https://archive.apache.org/dist/httpd/httpd-%{version}.tar.bz2 @@ -115,6 +115,15 @@ Patch61: backport-Use-ap_os_is_path_absolute-to-make-it-portable.patch Patch62: backport-CVE-2024-24795-let-httpd-handle-CL-TE-for-non-http-handlers.patch Patch63: backport-CVE-2023-38709-header-validation-after-content.patch Patch64: backport-CVE-2024-27316-bail-after-too-many-failed-reads.patch +Patch65: backport-CVE-2024-38473-mod_proxy-escape-for-non-proxypass-configuration.patch +Patch66: backport-CVE-2024-38473-mod_proxy-Fixup-UDS-filename.patch +Patch67: backport-CVE-2024-38473-CVE-2024-39573-block-inadvertent-subst-of-special-filename.patch +Patch68: backport-CVE-2024-38473-fix-comparsion-of-local-path.patch +Patch69: backport-CVE-2024-38473-fix-the-filename-redirected.patch +Patch70: backport-CVE-2024-38474-CVE-2024-38475-tighten-up-prefix_stat.patch +Patch71: backport-CVE-2024-38476-add-ap_set_content_type_ex-to-differentiate-trusted-sources.patch +Patch72: backport-CVE-2024-38477-validate-hostsname.patch +Patch73: backport-CVE-2024-39884-maintain-trusted-flag.patch BuildRequires: gcc autoconf pkgconfig findutils xmlto perl-interpreter perl-generators systemd-devel BuildRequires: zlib-devel libselinux-devel lua-devel brotli-devel @@ -551,6 +560,12 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Mon Jul 08 2024 chengyechun <chengyechun1@huawei.com> - 2.4.43-25 +- Type:CVE +- ID:CVE-2024-38473,CVE-2024-38474,CVE-2024-38475,CVE-2024-38476,CVE-2024-38477,CVE-2024-39884,CVE-2024-39573 +- SUG:NA +- DSEC:fix some CVEs + * Tue May 07 2024 chengyechun <chengyechun1@huaiwe.com> - 2.4.43-24 - Type:CVE - ID:CVE-2024-24795,CVE-2023-38709,CVE-2024-27316