diff --git a/backport-CVE-2024-38473-CVE-2024-39573-block-inadvertent-subst-of-special-filename.patch b/backport-CVE-2024-38473-CVE-2024-39573-block-inadvertent-subst-of-special-filename.patch new file mode 100644 index 0000000000000000000000000000000000000000..aa83a124d6ceab59331dec1cd261de797b28c5ea --- /dev/null +++ b/backport-CVE-2024-38473-CVE-2024-39573-block-inadvertent-subst-of-special-filename.patch @@ -0,0 +1,79 @@ +From 93aec0e3ca451bcc97f6d91c14d5399d13a73365 Mon Sep 17 00:00:00 2001 +From: Eric Covener +Date: Tue, 25 Jun 2024 15:28:00 +0000 +Subject: [PATCH] Merge r1918553 from trunk: + +block inadvertent subst of special filenames + ++ cosmetic merge conflicts + + + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918600 13f79535-47bb-0310-9956-ffa450edef68 + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/93aec0e3ca451bcc97f6d91c14d5399d13a73365 + +--- + modules/mappers/mod_rewrite.c | 38 ++++++++++++++++++++++++----------- + 1 file changed, 26 insertions(+), 12 deletions(-) + +diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c +index bbcc11b..a231b7c 100644 +--- a/modules/mappers/mod_rewrite.c ++++ b/modules/mappers/mod_rewrite.c +@@ -4280,6 +4280,32 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + return 2; + } + ++ /* Add the previously stripped per-directory location prefix, unless ++ * (1) it's an absolute URL path and ++ * (2) it's a full qualified URL ++ */ ++ if (!is_proxyreq && *newuri != '/' && !is_absolute_uri(newuri, NULL)) { ++ if (ctx->perdir) { ++ rewritelog((r, 3, ctx->perdir, "add per-dir prefix: %s -> %s%s", ++ newuri, ctx->perdir, newuri)); ++ ++ newuri = apr_pstrcat(r->pool, ctx->perdir, newuri, NULL); ++ } ++ else if (!(p->flags & (RULEFLAG_PROXY | RULEFLAG_FORCEREDIRECT))) { ++ /* Not an absolute URI-path and the scheme (if any) is unknown, ++ * and it won't be passed to fully_qualify_uri() below either, ++ * so add an implicit '/' prefix. This avoids potentially a common ++ * rule like "RewriteRule ^/some/path(.*) $1" that is given a path ++ * like "/some/pathscheme:..." to produce the fully qualified URL ++ * "scheme:..." which could be misinterpreted later. ++ */ ++ rewritelog((r, 3, ctx->perdir, "add root prefix: %s -> /%s", ++ newuri, newuri)); ++ ++ newuri = apr_pstrcat(r->pool, "/", newuri, NULL); ++ } ++ } ++ + /* Now adjust API's knowledge about r->filename and r->args */ + r->filename = newuri; + +@@ -4289,18 +4315,6 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + + splitout_queryargs(r, p->flags); + +- /* Add the previously stripped per-directory location prefix, unless +- * (1) it's an absolute URL path and +- * (2) it's a full qualified URL +- */ +- if ( ctx->perdir && !is_proxyreq && *r->filename != '/' +- && !is_absolute_uri(r->filename, NULL)) { +- rewritelog((r, 3, ctx->perdir, "add per-dir prefix: %s -> %s%s", +- r->filename, ctx->perdir, r->filename)); +- +- r->filename = apr_pstrcat(r->pool, ctx->perdir, r->filename, NULL); +- } +- + /* If this rule is forced for proxy throughput + * (`RewriteRule ... ... [P]') then emulate mod_proxy's + * URL-to-filename handler to be sure mod_proxy is triggered +-- +2.33.0 + diff --git a/backport-CVE-2024-38473-fix-comparsion-of-local-path.patch b/backport-CVE-2024-38473-fix-comparsion-of-local-path.patch new file mode 100644 index 0000000000000000000000000000000000000000..65894b21769e7707f0acb0e8c25e9b715fff0e07 --- /dev/null +++ b/backport-CVE-2024-38473-fix-comparsion-of-local-path.patch @@ -0,0 +1,58 @@ +From cc00cf6b4e37370897daddc307bf1deecf8fedfa Mon Sep 17 00:00:00 2001 +From: Eric Covener +Date: Tue, 25 Jun 2024 20:20:05 +0000 +Subject: [PATCH] Merge r1918623 from trunk: + +fix comparison of local path on Windows + +Submitted By: Yann Ylavic + + + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918625 13f79535-47bb-0310-9956-ffa450edef68 + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/cc00cf6b4e37370897daddc307bf1deecf8fedfa + +--- + modules/mappers/mod_rewrite.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c +index a231b7c..6076cc2 100644 +--- a/modules/mappers/mod_rewrite.c ++++ b/modules/mappers/mod_rewrite.c +@@ -642,6 +642,19 @@ static unsigned is_absolute_uri(char *uri, int *supportsqs) + return 0; + } + ++static int is_absolute_path(const char *path) ++{ ++#ifndef WIN32 ++ return (path[0] == '/'); ++#else ++#define IS_SLASH(c) ((c) == '/' || (c) == '\\') ++ /* "//", "\\", "x:/" and "x:\" are absolute paths on Windows */ ++ return ((IS_SLASH(path[0]) && path[1] == path[0]) ++ || (apr_isalpha(path[0]) && path[1] == ':' && IS_SLASH(path[2]))); ++#undef IS_SLASH ++#endif ++} ++ + static const char c2x_table[] = "0123456789abcdef"; + + static APR_INLINE unsigned char *c2x(unsigned what, unsigned char prefix, +@@ -4284,7 +4297,9 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + * (1) it's an absolute URL path and + * (2) it's a full qualified URL + */ +- if (!is_proxyreq && *newuri != '/' && !is_absolute_uri(newuri, NULL)) { ++ if (!is_proxyreq ++ && !is_absolute_path(newuri) ++ && !is_absolute_uri(newuri, NULL)) { + if (ctx->perdir) { + rewritelog((r, 3, ctx->perdir, "add per-dir prefix: %s -> %s%s", + newuri, ctx->perdir, newuri)); +-- +2.33.0 + diff --git a/backport-CVE-2024-38473-fix-the-filename-redirected.patch b/backport-CVE-2024-38473-fix-the-filename-redirected.patch new file mode 100644 index 0000000000000000000000000000000000000000..6888d50db254d45e5cd8bdbe346237dce4ae1096 --- /dev/null +++ b/backport-CVE-2024-38473-fix-the-filename-redirected.patch @@ -0,0 +1,215 @@ +From 4326d6b9041a3bcb9b529f9163d0761c2d760700 Mon Sep 17 00:00:00 2001 +From: Yann Ylavic +Date: Wed, 26 Jun 2024 14:56:47 +0000 +Subject: [PATCH] factor out IS_SLASH, perdir fix + +in per-dir, the filename will be internally redirected, so / is OK too. + + +don't add / to / in the non-perdir + + +match AP_IS_SLASH macro + +followup to 1918651 + + +Merges r1918651, r1918652, r1918663 from trunk +Reviewed by: covener, ylavic, rpluem +GH: close #458 + + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918668 13f79535-47bb-0310-9956-ffa450edef68 + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/4326d6b9041a3bcb9b529f9163d0761c2d760700 + +--- + include/ap_mmn.h | 3 ++- + include/httpd.h | 11 +++++++++++ + modules/mappers/mod_rewrite.c | 11 ++++------- + server/util.c | 31 ++++++++++--------------------- + 4 files changed, 27 insertions(+), 29 deletions(-) + +diff --git a/include/ap_mmn.h b/include/ap_mmn.h +index ad7e3ba..866a26b 100644 +--- a/include/ap_mmn.h ++++ b/include/ap_mmn.h +@@ -598,6 +598,7 @@ + * 20120211.128 (2.4.55-dev) Add AP_CTIME_OPTION_GMTOFF to util_time.h + * 20120211.129 (2.4.58-dev) Add ap_get_pollfd_from_conn() + * 20120211.133 (2.4.60-dev) Add ap_proxy_fixup_uds_filename() ++ * 20120211.134 (2.4.60-dev) AP_SLASHES and AP_IS_SLASH + */ + + #define MODULE_MAGIC_COOKIE 0x41503234UL /* "AP24" */ +@@ -605,7 +606,7 @@ + #ifndef MODULE_MAGIC_NUMBER_MAJOR + #define MODULE_MAGIC_NUMBER_MAJOR 20120211 + #endif +-#define MODULE_MAGIC_NUMBER_MINOR 133 /* 0...n */ ++#define MODULE_MAGIC_NUMBER_MINOR 134 /* 0...n */ + + /** + * Determine if the server's current MODULE_MAGIC_NUMBER is at least a +diff --git a/include/httpd.h b/include/httpd.h +index 799cf97..1549be0 100644 +--- a/include/httpd.h ++++ b/include/httpd.h +@@ -2656,6 +2656,17 @@ AP_DECLARE(const char *)ap_dir_fnmatch(ap_dir_match_t *w, const char *path, + */ + AP_DECLARE(int) ap_is_chunked(apr_pool_t *p, const char *line); + ++/* Win32/NetWare/OS2 need to check for both forward and back slashes ++ * in ap_normalize_path() and ap_escape_url(). ++ */ ++#ifdef CASE_BLIND_FILESYSTEM ++#define AP_IS_SLASH(s) ((s == '/') || (s == '\\')) ++#define AP_SLASHES "/\\" ++#else ++#define AP_IS_SLASH(s) (s == '/') ++#define AP_SLASHES "/" ++#endif ++ + #ifdef __cplusplus + } + #endif +diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c +index 6076cc2..92a3f64 100644 +--- a/modules/mappers/mod_rewrite.c ++++ b/modules/mappers/mod_rewrite.c +@@ -644,14 +644,11 @@ static unsigned is_absolute_uri(char *uri, int *supportsqs) + + static int is_absolute_path(const char *path) + { +-#ifndef WIN32 ++#ifndef CASE_BLIND_FILESYSTEM + return (path[0] == '/'); + #else +-#define IS_SLASH(c) ((c) == '/' || (c) == '\\') +- /* "//", "\\", "x:/" and "x:\" are absolute paths on Windows */ +- return ((IS_SLASH(path[0]) && path[1] == path[0]) +- || (apr_isalpha(path[0]) && path[1] == ':' && IS_SLASH(path[2]))); +-#undef IS_SLASH ++ return ((AP_IS_SLASH(path[0]) && path[1] == path[0]) ++ || (apr_isalpha(path[0]) && path[1] == ':' && AP_IS_SLASH(path[2]))); + #endif + } + +@@ -4299,11 +4296,11 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + */ + if (!is_proxyreq + && !is_absolute_path(newuri) ++ && !AP_IS_SLASH(*newuri) + && !is_absolute_uri(newuri, NULL)) { + if (ctx->perdir) { + rewritelog((r, 3, ctx->perdir, "add per-dir prefix: %s -> %s%s", + newuri, ctx->perdir, newuri)); +- + newuri = apr_pstrcat(r->pool, ctx->perdir, newuri, NULL); + } + else if (!(p->flags & (RULEFLAG_PROXY | RULEFLAG_FORCEREDIRECT))) { +diff --git a/server/util.c b/server/util.c +index 4602c7a..daa2017 100644 +--- a/server/util.c ++++ b/server/util.c +@@ -75,17 +75,6 @@ + */ + #include "test_char.h" + +-/* Win32/NetWare/OS2 need to check for both forward and back slashes +- * in ap_normalize_path() and ap_escape_url(). +- */ +-#ifdef CASE_BLIND_FILESYSTEM +-#define IS_SLASH(s) ((s == '/') || (s == '\\')) +-#define SLASHES "/\\" +-#else +-#define IS_SLASH(s) (s == '/') +-#define SLASHES "/" +-#endif +- + /* we know core's module_index is 0 */ + #undef APLOG_MODULE_INDEX + #define APLOG_MODULE_INDEX AP_CORE_MODULE_INDEX +@@ -492,7 +481,7 @@ AP_DECLARE(apr_status_t) ap_pregsub_ex(apr_pool_t *p, char **result, + /* Forward declare */ + static char x2c(const char *what); + +-#define IS_SLASH_OR_NUL(s) (s == '\0' || IS_SLASH(s)) ++#define IS_SLASH_OR_NUL(s) (s == '\0' || AP_IS_SLASH(s)) + + /* + * Inspired by mod_jk's jk_servlet_normalize(). +@@ -504,7 +493,7 @@ AP_DECLARE(int) ap_normalize_path(char *path, unsigned int flags) + int decode_unreserved = (flags & AP_NORMALIZE_DECODE_UNRESERVED) != 0; + int merge_slashes = (flags & AP_NORMALIZE_MERGE_SLASHES) != 0; + +- if (!IS_SLASH(path[0])) { ++ if (!AP_IS_SLASH(path[0])) { + /* Besides "OPTIONS *", a request-target should start with '/' + * per RFC 7230 section 5.3, so anything else is invalid. + */ +@@ -545,12 +534,12 @@ AP_DECLARE(int) ap_normalize_path(char *path, unsigned int flags) + } + } + +- if (w == 0 || IS_SLASH(path[w - 1])) { ++ if (w == 0 || AP_IS_SLASH(path[w - 1])) { + /* Collapse ///// sequences to / */ +- if (merge_slashes && IS_SLASH(path[l])) { ++ if (merge_slashes && AP_IS_SLASH(path[l])) { + do { + l++; +- } while (IS_SLASH(path[l])); ++ } while (AP_IS_SLASH(path[l])); + continue; + } + +@@ -579,7 +568,7 @@ AP_DECLARE(int) ap_normalize_path(char *path, unsigned int flags) + if (w > 1) { + do { + w--; +- } while (w && !IS_SLASH(path[w - 1])); ++ } while (w && !AP_IS_SLASH(path[w - 1])); + } + else { + /* Already at root, ignore and return a failure +@@ -1915,7 +1904,7 @@ static int unescape_url(char *url, const char *forbid, const char *reserved, + char decoded; + decoded = x2c(y + 1); + if ((decoded == '\0') +- || (forbid_slashes && IS_SLASH(decoded)) ++ || (forbid_slashes && AP_IS_SLASH(decoded)) + || (forbid && ap_strchr_c(forbid, decoded))) { + badpath = 1; + *x = decoded; +@@ -1923,7 +1912,7 @@ static int unescape_url(char *url, const char *forbid, const char *reserved, + } + else if ((keep_unreserved && TEST_CHAR(decoded, + T_URI_UNRESERVED)) +- || (keep_slashes && IS_SLASH(decoded)) ++ || (keep_slashes && AP_IS_SLASH(decoded)) + || (reserved && ap_strchr_c(reserved, decoded))) { + *x++ = *y++; + *x++ = *y++; +@@ -1950,7 +1939,7 @@ static int unescape_url(char *url, const char *forbid, const char *reserved, + AP_DECLARE(int) ap_unescape_url(char *url) + { + /* Traditional */ +- return unescape_url(url, SLASHES, NULL, 0); ++ return unescape_url(url, AP_SLASHES, NULL, 0); + } + AP_DECLARE(int) ap_unescape_url_keep2f(char *url, int decode_slashes) + { +@@ -1960,7 +1949,7 @@ AP_DECLARE(int) ap_unescape_url_keep2f(char *url, int decode_slashes) + return unescape_url(url, NULL, NULL, 0); + } else { + /* reserve (do not decode) encoded slashes */ +- return unescape_url(url, NULL, SLASHES, 0); ++ return unescape_url(url, NULL, AP_SLASHES, 0); + } + } + AP_DECLARE(int) ap_unescape_url_ex(char *url, unsigned int flags) +-- +2.33.0 + diff --git a/backport-CVE-2024-38473-mod_proxy-Fixup-UDS-filename.patch b/backport-CVE-2024-38473-mod_proxy-Fixup-UDS-filename.patch new file mode 100644 index 0000000000000000000000000000000000000000..1f5d1d76379769df173585aa4299d5e551f73218 --- /dev/null +++ b/backport-CVE-2024-38473-mod_proxy-Fixup-UDS-filename.patch @@ -0,0 +1,236 @@ +From 6b8e043ce4f27114e6ae1b8176b629b7cb3fbbce Mon Sep 17 00:00:00 2001 +From: Yann Ylavic +Date: Wed, 26 Jun 2024 14:51:32 +0000 +Subject: [PATCH] mod_proxy: Fixup UDS filename for mod_proxy called through + r->handler. + +* modules/proxy/proxy_util.c: + Export ap_proxy_fixup_uds_filename() from fix_uds_filename. + Call it from ap_proxy_pre_request() even for rewritten balancer workers. + +* modules/proxy/mod_proxy.h: + Declare ap_proxy_fixup_uds_filename() + +* modules/proxy/mod_proxy.c: + Fixup UDS filename from r->handler in proxy_handler(). + +* include/ap_mmn.h: + Bump MMN minor for ap_proxy_fixup_uds_filename() + + +mod_proxy: follow up to r1918626: Simplify ap_proxy_fixup_uds_filename() and callers. + + +Merges r1918626, r1918647 from trunk +GH: closes #457 + + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918666 13f79535-47bb-0310-9956-ffa450edef68 + +Conflict:Version adaptation exists in ap_mmn.h +Reference:https://github.com/apache/httpd/commit/6b8e043ce4f27114e6ae1b8176b629b7cb3fbbce + +--- + include/ap_mmn.h | 3 ++- + modules/proxy/mod_proxy.c | 33 ++++++++++++++++++------------ + modules/proxy/mod_proxy.h | 8 ++++++++ + modules/proxy/proxy_util.c | 41 ++++++++++++++++++++++---------------- + 4 files changed, 54 insertions(+), 31 deletions(-) + +diff --git a/include/ap_mmn.h b/include/ap_mmn.h +index e008a48..ad7e3ba 100644 +--- a/include/ap_mmn.h ++++ b/include/ap_mmn.h +@@ -597,6 +597,7 @@ + * 20120211.127 (2.4.56-dev) Add ap_proxy_canonenc_ex + * 20120211.128 (2.4.55-dev) Add AP_CTIME_OPTION_GMTOFF to util_time.h + * 20120211.129 (2.4.58-dev) Add ap_get_pollfd_from_conn() ++ * 20120211.133 (2.4.60-dev) Add ap_proxy_fixup_uds_filename() + */ + + #define MODULE_MAGIC_COOKIE 0x41503234UL /* "AP24" */ +@@ -604,7 +605,7 @@ + #ifndef MODULE_MAGIC_NUMBER_MAJOR + #define MODULE_MAGIC_NUMBER_MAJOR 20120211 + #endif +-#define MODULE_MAGIC_NUMBER_MINOR 129 /* 0...n */ ++#define MODULE_MAGIC_NUMBER_MINOR 133 /* 0...n */ + + /** + * Determine if the server's current MODULE_MAGIC_NUMBER is at least a +diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c +index 34c1ceb..ee5b828 100644 +--- a/modules/proxy/mod_proxy.c ++++ b/modules/proxy/mod_proxy.c +@@ -1227,6 +1227,7 @@ static int proxy_fixup(request_rec *r) + + return OK; /* otherwise; we've done the best we can */ + } ++ + /* Send a redirection if the request contains a hostname which is not */ + /* fully qualified, i.e. doesn't have a domain name appended. Some proxy */ + /* servers like Netscape's allow this and access hosts from the local */ +@@ -1280,7 +1281,7 @@ static int proxy_handler(request_rec *r) + ap_get_module_config(sconf, &proxy_module); + apr_array_header_t *proxies = conf->proxies; + struct proxy_remote *ents = (struct proxy_remote *) proxies->elts; +- int i, rc, access_status; ++ int rc = DECLINED, access_status, i; + int direct_connect = 0; + const char *str; + apr_int64_t maxfwd; +@@ -1295,22 +1296,28 @@ static int proxy_handler(request_rec *r) + return DECLINED; + } + +- if (!r->proxyreq) { +- rc = DECLINED; +- /* We may have forced the proxy handler via config or .htaccess */ +- if (r->handler && +- strncmp(r->handler, "proxy:", 6) == 0 && +- strncmp(r->filename, "proxy:", 6) != 0) { +- r->proxyreq = PROXYREQ_REVERSE; +- r->filename = apr_pstrcat(r->pool, r->handler, r->filename, NULL); +- /* Still need to fixup/canonicalize r->filename */ ++ /* We may have forced the proxy handler via config or .htaccess */ ++ if (!r->proxyreq && r->handler && strncmp(r->handler, "proxy:", 6) == 0) { ++ char *old_filename = r->filename; ++ ++ r->proxyreq = PROXYREQ_REVERSE; ++ r->filename = apr_pstrcat(r->pool, r->handler, r->filename, NULL); ++ ++ /* Still need to fixup/canonicalize r->filename */ ++ rc = ap_proxy_fixup_uds_filename(r); ++ if (rc <= OK) { + rc = proxy_fixup(r); + } + if (rc != OK) { +- return rc; ++ r->filename = old_filename; ++ r->proxyreq = 0; + } +- } else if (strncmp(r->filename, "proxy:", 6) != 0) { +- return DECLINED; ++ } ++ else if (r->proxyreq && strncmp(r->filename, "proxy:", 6) == 0) { ++ rc = OK; ++ } ++ if (rc != OK) { ++ return rc; + } + + /* handle max-forwards / OPTIONS / TRACE */ +diff --git a/modules/proxy/mod_proxy.h b/modules/proxy/mod_proxy.h +index c51145e..868a1e9 100644 +--- a/modules/proxy/mod_proxy.h ++++ b/modules/proxy/mod_proxy.h +@@ -993,6 +993,14 @@ PROXY_DECLARE(proxy_balancer_shared *) ap_proxy_find_balancershm(ap_slotmem_prov + proxy_balancer *balancer, + unsigned int *index); + ++/* ++ * Strip the UDS part of r->filename if any, and put the UDS path in ++ * r->notes ("uds_path") ++ * @param r current request ++ * @return OK if fixed up, DECLINED if not UDS, or an HTTP_XXX error ++ */ ++PROXY_DECLARE(int) ap_proxy_fixup_uds_filename(request_rec *r); ++ + /** + * Get the most suitable worker and/or balancer for the request + * @param worker worker used for processing request +diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c +index 0500570..541e944 100644 +--- a/modules/proxy/proxy_util.c ++++ b/modules/proxy/proxy_util.c +@@ -2316,7 +2316,7 @@ static int ap_proxy_retry_worker(const char *proxy_function, proxy_worker *worke + * were passed a UDS url (eg: from mod_proxy) and adjust uds_path + * as required. + */ +-static int fix_uds_filename(request_rec *r, char **url) ++PROXY_DECLARE(int) ap_proxy_fixup_uds_filename(request_rec *r) + { + char *uds_url = r->filename + 6, *origin_url; + +@@ -2324,7 +2324,6 @@ static int fix_uds_filename(request_rec *r, char **url) + !ap_cstr_casecmpn(uds_url, "unix:", 5) && + (origin_url = ap_strchr(uds_url + 5, '|'))) { + char *uds_path = NULL; +- apr_size_t url_len; + apr_uri_t urisock; + apr_status_t rv; + +@@ -2339,20 +2338,20 @@ static int fix_uds_filename(request_rec *r, char **url) + if (!uds_path) { + ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10292) + "Invalid proxy UDS filename (%s)", r->filename); +- return 0; ++ return HTTP_BAD_REQUEST; + } + apr_table_setn(r->notes, "uds_path", uds_path); + +- /* Remove the UDS path from *url and r->filename */ +- url_len = strlen(origin_url); +- *url = apr_pstrmemdup(r->pool, origin_url, url_len); +- memcpy(uds_url, *url, url_len + 1); +- + ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r, +- "*: rewrite of url due to UDS(%s): %s (%s)", +- uds_path, *url, r->filename); ++ "*: fixup UDS from %s: %s (%s)", ++ r->filename, origin_url, uds_path); ++ ++ /* Overwrite the UDS part in place */ ++ memmove(uds_url, origin_url, strlen(origin_url) + 1); ++ return OK; + } +- return 1; ++ ++ return DECLINED; + } + + PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker, +@@ -2371,9 +2370,6 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker, + ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r, + "%s: found worker %s for %s", + (*worker)->s->scheme, (*worker)->s->name_ex, *url); +- if (!forward && !fix_uds_filename(r, url)) { +- return HTTP_INTERNAL_SERVER_ERROR; +- } + access_status = OK; + } + else if (forward) { +@@ -2403,9 +2399,6 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker, + * regarding the Connection header in the request. + */ + apr_table_setn(r->subprocess_env, "proxy-nokeepalive", "1"); +- if (!fix_uds_filename(r, url)) { +- return HTTP_INTERNAL_SERVER_ERROR; +- } + } + } + } +@@ -2415,6 +2408,20 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker, + "all workers are busy. Unable to serve %s", *url); + access_status = HTTP_SERVICE_UNAVAILABLE; + } ++ ++ if (access_status == OK && r->proxyreq == PROXYREQ_REVERSE) { ++ int rc = ap_proxy_fixup_uds_filename(r); ++ if (ap_is_HTTP_ERROR(rc)) { ++ return rc; ++ } ++ /* If the URL has changed in r->filename, take everything after ++ * the "proxy:" prefix. ++ */ ++ if (rc == OK) { ++ *url = apr_pstrdup(r->pool, r->filename + 6); ++ } ++ } ++ + return access_status; + } + +-- +2.33.0 + diff --git a/backport-CVE-2024-38473-mod_proxy-escape-for-non-proxypass-configuration.patch b/backport-CVE-2024-38473-mod_proxy-escape-for-non-proxypass-configuration.patch new file mode 100644 index 0000000000000000000000000000000000000000..7fa1e391048b78b9475a8d14b7f8b289baff478c --- /dev/null +++ b/backport-CVE-2024-38473-mod_proxy-escape-for-non-proxypass-configuration.patch @@ -0,0 +1,44 @@ +From b10cb2d69184843832d501a615abe3e8e5e256dc Mon Sep 17 00:00:00 2001 +From: Eric Covener +Date: Mon, 24 Jun 2024 17:52:31 +0000 +Subject: [PATCH] Merge r1918550 from trunk: + +mod_proxy: escape for non-proxypass configuration + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918559 13f79535-47bb-0310-9956-ffa450edef68 + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/b10cb2d69184843832d501a615abe3e8e5e256dc + +--- + modules/proxy/mod_proxy.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c +index 537c3c2..34c1ceb 100644 +--- a/modules/proxy/mod_proxy.c ++++ b/modules/proxy/mod_proxy.c +@@ -1296,15 +1296,18 @@ static int proxy_handler(request_rec *r) + } + + if (!r->proxyreq) { ++ rc = DECLINED; + /* We may have forced the proxy handler via config or .htaccess */ + if (r->handler && + strncmp(r->handler, "proxy:", 6) == 0 && + strncmp(r->filename, "proxy:", 6) != 0) { + r->proxyreq = PROXYREQ_REVERSE; + r->filename = apr_pstrcat(r->pool, r->handler, r->filename, NULL); ++ /* Still need to fixup/canonicalize r->filename */ ++ rc = proxy_fixup(r); + } +- else { +- return DECLINED; ++ if (rc != OK) { ++ return rc; + } + } else if (strncmp(r->filename, "proxy:", 6) != 0) { + return DECLINED; +-- +2.33.0 + diff --git a/backport-CVE-2024-38474-CVE-2024-38475-tighten-up-prefix_stat.patch b/backport-CVE-2024-38474-CVE-2024-38475-tighten-up-prefix_stat.patch new file mode 100644 index 0000000000000000000000000000000000000000..a8000aeab29729eeb75d32f81d20a0d9f1e0461c --- /dev/null +++ b/backport-CVE-2024-38474-CVE-2024-38475-tighten-up-prefix_stat.patch @@ -0,0 +1,405 @@ +From 1feb5e04a4f7b5f3f13cd40f9635144319dcf24a Mon Sep 17 00:00:00 2001 +From: Eric Covener +Date: Mon, 24 Jun 2024 17:58:17 +0000 +Subject: [PATCH] Merge r1918552 from trunk: + +tighten up prefix_stat and %3f handling + +Require opt-ins for unsafe substitutions + + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918561 13f79535-47bb-0310-9956-ffa450edef68 + +Conflict:The XML file does not exist. Therefore, the file is not modified. +Reference:https://github.com/apache/httpd/commit/1feb5e04a4f7b5f3f13cd40f9635144319dcf24a + +--- + modules/mappers/mod_rewrite.c | 151 +++++++++++++++++++++++++++------- + 1 file changed, 123 insertions(+), 28 deletions(-) + +diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c +index 92a3f64..024808b 100644 +--- a/modules/mappers/mod_rewrite.c ++++ b/modules/mappers/mod_rewrite.c +@@ -177,6 +177,8 @@ static const char* really_last_key = "rewrite_really_last"; + #define RULEFLAG_QSLAST (1<<19) + #define RULEFLAG_QSNONE (1<<20) /* programattic only */ + #define RULEFLAG_ESCAPECTLS (1<<21) ++#define RULEFLAG_UNSAFE_PREFIX_STAT (1<<22) ++#define RULEFLAG_UNSAFE_ALLOW3F (1<<23) + + /* return code of the rewrite rule + * the result may be escaped - or not +@@ -184,7 +186,7 @@ static const char* really_last_key = "rewrite_really_last"; + #define ACTION_NORMAL (1<<0) + #define ACTION_NOESCAPE (1<<1) + #define ACTION_STATUS (1<<2) +- ++#define ACTION_STATUS_SET (1<<3) + + #define MAPTYPE_TXT (1<<0) + #define MAPTYPE_DBM (1<<1) +@@ -208,6 +210,7 @@ static const char* really_last_key = "rewrite_really_last"; + #define OPTION_IGNORE_INHERIT (1<<8) + #define OPTION_IGNORE_CONTEXT_INFO (1<<9) + #define OPTION_LEGACY_PREFIX_DOCROOT (1<<10) ++#define OPTION_UNSAFE_PREFIX_STAT (1<<12) + + #ifndef RAND_MAX + #define RAND_MAX 32767 +@@ -301,6 +304,14 @@ typedef enum { + CONDPAT_AP_EXPR + } pattern_type; + ++typedef enum { ++ RULE_RC_NOMATCH = 0, /* the rule didn't match */ ++ RULE_RC_MATCH = 1, /* a matching rule w/ substitution */ ++ RULE_RC_NOSUB = 2, /* a matching rule w/ no substitution */ ++ RULE_RC_STATUS_SET = 3 /* a matching rule that has set an HTTP error ++ to be returned in r->status */ ++} rule_return_type; ++ + typedef struct { + char *input; /* Input string of RewriteCond */ + char *pattern; /* the RegExp pattern string */ +@@ -937,10 +948,15 @@ static void fully_qualify_uri(request_rec *r) + return; + } + ++static int startsWith(request_rec *r, const char *haystack, const char *needle) { ++ int rc = (ap_strstr_c(haystack, needle) == haystack); ++ rewritelog((r, 5, NULL, "prefix_stat startsWith(%s, %s) %d", haystack, needle, rc)); ++ return rc; ++} + /* +- * stat() only the first segment of a path ++ * stat() only the first segment of a path, and only if it matches the output of the last matching rule + */ +-static int prefix_stat(const char *path, apr_pool_t *pool) ++static int prefix_stat(request_rec *r, const char *path, apr_pool_t *pool, rewriterule_entry *lastsub) + { + const char *curpath = path; + const char *root; +@@ -974,10 +990,36 @@ static int prefix_stat(const char *path, apr_pool_t *pool) + apr_finfo_t sb; + + if (apr_stat(&sb, statpath, APR_FINFO_MIN, pool) == APR_SUCCESS) { +- return 1; ++ if (!lastsub) { ++ rewritelog((r, 3, NULL, "prefix_stat no lastsub subst prefix %s", statpath)); ++ return 1; ++ } ++ ++ rewritelog((r, 3, NULL, "prefix_stat compare statpath %s and lastsub output %s STATOK %d ", ++ statpath, lastsub->output, lastsub->flags & RULEFLAG_UNSAFE_PREFIX_STAT)); ++ if (lastsub->flags & RULEFLAG_UNSAFE_PREFIX_STAT) { ++ return 1; ++ } ++ else { ++ const char *docroot = ap_document_root(r); ++ const char *context_docroot = ap_context_document_root(r); ++ /* ++ * As an example, path (r->filename) is /var/foo/bar/baz.html ++ * even if the flag is not set, we can accept a rule that ++ * began with a literal /var (stapath), or if the entire path ++ * starts with the docroot or context document root ++ */ ++ if (startsWith(r, lastsub->output, statpath) || ++ startsWith(r, path, docroot) || ++ ((docroot != context_docroot) && ++ startsWith(r, path, context_docroot))) { ++ return 1; ++ } ++ } + } + } + ++ /* prefix will be added */ + return 0; + } + +@@ -3082,6 +3124,9 @@ static const char *cmd_rewriteoptions(cmd_parms *cmd, + else if (!strcasecmp(w, "legacyprefixdocroot")) { + options |= OPTION_LEGACY_PREFIX_DOCROOT; + } ++ else if (!strcasecmp(w, "UnsafePrefixStat")) { ++ options |= OPTION_UNSAFE_PREFIX_STAT; ++ } + else { + return apr_pstrcat(cmd->pool, "RewriteOptions: unknown option '", + w, "'", NULL); +@@ -3790,6 +3835,18 @@ static const char *cmd_rewriterule_setflag(apr_pool_t *p, void *_cfg, + ++error; + } + break; ++ case 'u': ++ case 'U': ++ if (!strcasecmp(key, "nsafePrefixStat")){ ++ cfg->flags |= (RULEFLAG_UNSAFE_PREFIX_STAT); ++ } ++ else if(!strcasecmp(key, "nsafeAllow3F")) { ++ cfg->flags |= RULEFLAG_UNSAFE_ALLOW3F; ++ } ++ else { ++ ++error; ++ } ++ break; + default: + ++error; + break; +@@ -4148,7 +4205,8 @@ static APR_INLINE void force_type_handler(rewriterule_entry *p, + /* + * Apply a single RewriteRule + */ +-static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) ++static rule_return_type apply_rewrite_rule(rewriterule_entry *p, ++ rewrite_ctx *ctx) + { + ap_regmatch_t regmatch[AP_MAX_REG_MATCH]; + apr_array_header_t *rewriteconds; +@@ -4199,7 +4257,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + rc = !ap_regexec(p->regexp, ctx->uri, AP_MAX_REG_MATCH, regmatch, 0); + if (! (( rc && !(p->flags & RULEFLAG_NOTMATCH)) || + (!rc && (p->flags & RULEFLAG_NOTMATCH)) ) ) { +- return 0; ++ return RULE_RC_NOMATCH; + } + + /* It matched, wow! Now it's time to prepare the context structure for +@@ -4250,7 +4308,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + } + } + else if (!rc) { +- return 0; ++ return RULE_RC_NOMATCH; + } + + /* If some HTTP header was involved in the condition, remember it +@@ -4270,6 +4328,15 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + newuri = do_expand(p->output, ctx, p); + rewritelog((r, 2, ctx->perdir, "rewrite '%s' -> '%s'", ctx->uri, + newuri)); ++ if (!(p->flags & RULEFLAG_UNSAFE_ALLOW3F) && ++ ap_strcasestr(r->unparsed_uri, "%3f") && ++ ap_strchr_c(newuri, '?')) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO() ++ "Unsafe URL with %%3f URL rewritten without " ++ "UnsafeAllow3F"); ++ r->status = HTTP_FORBIDDEN; ++ return RULE_RC_STATUS_SET; ++ } + } + + /* expand [E=var:val] and [CO=] */ +@@ -4287,7 +4354,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + r->status = p->forced_responsecode; + } + +- return 2; ++ return RULE_RC_NOSUB; + } + + /* Add the previously stripped per-directory location prefix, unless +@@ -4355,7 +4422,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + r->filename)); + + r->filename = apr_pstrcat(r->pool, "proxy:", r->filename, NULL); +- return 1; ++ return RULE_RC_MATCH; + } + + /* If this rule is explicitly forced for HTTP redirection +@@ -4370,7 +4437,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + r->filename)); + + r->status = p->forced_responsecode; +- return 1; ++ return RULE_RC_MATCH; + } + + /* Special Rewriting Feature: Self-Reduction +@@ -4392,7 +4459,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + "with %s", p->forced_responsecode, r->filename)); + + r->status = p->forced_responsecode; +- return 1; ++ return RULE_RC_MATCH; + } + + /* Finally remember the forced mime-type */ +@@ -4401,7 +4468,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + /* Puuhhhhhhhh... WHAT COMPLICATED STUFF ;_) + * But now we're done for this particular rule. + */ +- return 1; ++ return RULE_RC_MATCH; + } + + /* +@@ -4409,13 +4476,13 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + * i.e. a list of rewrite rules + */ + static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules, +- char *perdir) ++ char *perdir, rewriterule_entry **lastsub) + { + rewriterule_entry *entries; + rewriterule_entry *p; + int i; + int changed; +- int rc; ++ rule_return_type rc; + int s; + rewrite_ctx *ctx; + int round = 1; +@@ -4423,6 +4490,7 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules, + ctx = apr_palloc(r->pool, sizeof(*ctx)); + ctx->perdir = perdir; + ctx->r = r; ++ *lastsub = NULL; + + /* + * Iterate over all existing rules +@@ -4450,7 +4518,12 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules, + ctx->vary = NULL; + rc = apply_rewrite_rule(p, ctx); + +- if (rc) { ++ if (rc != RULE_RC_NOMATCH) { ++ ++ if (!(p->flags & RULEFLAG_NOSUB)) { ++ rewritelog((r, 2, perdir, "setting lastsub to rule with output %s", p->output)); ++ *lastsub = p; ++ } + + /* Catch looping rules with pathinfo growing unbounded */ + if ( strlen( r->filename ) > 2*r->server->limit_req_line ) { +@@ -4470,6 +4543,12 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules, + apr_table_merge(r->headers_out, "Vary", ctx->vary); + } + ++ ++ /* Error while evaluating rule, r->status set */ ++ if (RULE_RC_STATUS_SET == rc) { ++ return ACTION_STATUS_SET; ++ } ++ + /* + * The rule sets the response code (implies match-only) + */ +@@ -4480,7 +4559,7 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules, + /* + * Indicate a change if this was not a match-only rule. + */ +- if (rc != 2) { ++ if (rc != RULE_RC_NOSUB) { + changed = ((p->flags & RULEFLAG_NOESCAPE) + ? ACTION_NOESCAPE : ACTION_NORMAL); + } +@@ -4669,6 +4748,7 @@ static int hook_uri2file(request_rec *r) + int rulestatus; + void *skipdata; + const char *oargs; ++ rewriterule_entry *lastsub = NULL; + + /* + * retrieve the config structures +@@ -4780,7 +4860,7 @@ static int hook_uri2file(request_rec *r) + /* + * now apply the rules ... + */ +- rulestatus = apply_rewrite_list(r, conf->rewriterules, NULL); ++ rulestatus = apply_rewrite_list(r, conf->rewriterules, NULL, &lastsub); + apr_table_setn(r->notes, "mod_rewrite_rewritten", + apr_psprintf(r->pool,"%d",rulestatus)); + } +@@ -4811,6 +4891,9 @@ static int hook_uri2file(request_rec *r) + "characters or spaces"); + return HTTP_FORBIDDEN; + } ++ else if (ACTION_STATUS_SET == rulestatus) { ++ return r->status; ++ } + + if (ACTION_STATUS == rulestatus) { + int n = r->status; +@@ -4937,23 +5020,29 @@ static int hook_uri2file(request_rec *r) + return HTTP_BAD_REQUEST; + } + +- /* if there is no valid prefix, we call +- * the translator from the core and +- * prefix the filename with document_root ++ /* We have r->filename as a path in a server-context rewrite without ++ * the PT flag. The historical behavior is to treat it as a verbatim ++ * filesystem path iff the first component of the path exists and is ++ * readable by httpd. Otherwise, it is interpreted as DocumentRoot ++ * relative. + * + * NOTICE: + * We cannot leave out the prefix_stat because +- * - when we always prefix with document_root +- * then no absolute path can be created, e.g. via +- * emulating a ScriptAlias directive, etc. +- * - when we always NOT prefix with document_root ++ * - If we always prefix with document_root ++ * then no absolute path can could ever be used in ++ * a substitution. e.g. emulating an Alias. ++ * - If we never prefix with document_root + * then the files under document_root have to + * be references directly and document_root + * gets never used and will be a dummy parameter - +- * this is also bad ++ * this is also bad. ++ * - Later addition: This part is questionable. ++ * If we had never prefixed, users would just ++ * need %{DOCUMENT_ROOT} in substitutions or the ++ * [PT] flag. + * + * BUT: +- * Under real Unix systems this is no problem, ++ * Under real Unix systems this is no perf problem, + * because we only do stat() on the first directory + * and this gets cached by the kernel for along time! + */ +@@ -4962,7 +5051,9 @@ static int hook_uri2file(request_rec *r) + uri_reduced = apr_table_get(r->notes, "mod_rewrite_uri_reduced"); + } + +- if (!prefix_stat(r->filename, r->pool) || uri_reduced != NULL) { ++ if (!prefix_stat(r, r->filename, r->pool, ++ conf->options & OPTION_UNSAFE_PREFIX_STAT ? NULL : lastsub) ++ || uri_reduced != NULL) { + int res; + char *tmp = r->uri; + +@@ -5007,6 +5098,7 @@ static int hook_fixup(request_rec *r) + char *ofilename, *oargs; + int is_proxyreq; + void *skipdata; ++ rewriterule_entry *lastsub; + + dconf = (rewrite_perdir_conf *)ap_get_module_config(r->per_dir_config, + &rewrite_module); +@@ -5091,7 +5183,7 @@ static int hook_fixup(request_rec *r) + /* + * now apply the rules ... + */ +- rulestatus = apply_rewrite_list(r, dconf->rewriterules, dconf->directory); ++ rulestatus = apply_rewrite_list(r, dconf->rewriterules, dconf->directory, &lastsub); + if (rulestatus) { + unsigned skip_absolute = is_absolute_uri(r->filename, NULL); + int to_proxyreq = 0; +@@ -5113,6 +5205,9 @@ static int hook_fixup(request_rec *r) + "characters or spaces"); + return HTTP_FORBIDDEN; + } ++ else if (ACTION_STATUS_SET == rulestatus) { ++ return r->status; ++ } + + if (ACTION_STATUS == rulestatus) { + int n = r->status; +-- +2.33.0 + diff --git a/backport-CVE-2024-38476-add-ap_set_content_type_ex-to-differentiate-trusted-sources.patch b/backport-CVE-2024-38476-add-ap_set_content_type_ex-to-differentiate-trusted-sources.patch new file mode 100644 index 0000000000000000000000000000000000000000..2d37d29ed3c5570401f80a8ea2b4189eb87d6129 --- /dev/null +++ b/backport-CVE-2024-38476-add-ap_set_content_type_ex-to-differentiate-trusted-sources.patch @@ -0,0 +1,310 @@ +From 554554b0ebb14d6578adb70a389c57a0d5f18a3b Mon Sep 17 00:00:00 2001 +From: Eric Covener +Date: Mon, 24 Jun 2024 17:54:34 +0000 +Subject: [PATCH] Merge r1918551 from trunk: + +add ap_set_content_type_ex to differentiate + +trusted sources + + + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918560 13f79535-47bb-0310-9956-ffa450edef68 + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/554554b0ebb14d6578adb70a389c57a0d5f18a3b + +--- + include/http_protocol.h | 11 +++++++++++ + include/httpd.h | 7 +++++++ + modules/http/http_protocol.c | 6 ++++++ + modules/http/mod_mime.c | 20 ++++++++++---------- + modules/mappers/mod_actions.c | 6 ++++-- + modules/mappers/mod_negotiation.c | 8 ++++---- + modules/mappers/mod_rewrite.c | 2 +- + modules/metadata/mod_headers.c | 6 +++--- + modules/metadata/mod_mime_magic.c | 4 ++-- + server/config.c | 2 +- + server/core.c | 2 +- + 11 files changed, 50 insertions(+), 24 deletions(-) + +diff --git a/include/http_protocol.h b/include/http_protocol.h +index 94c481e..f2c99c9 100644 +--- a/include/http_protocol.h ++++ b/include/http_protocol.h +@@ -438,6 +438,17 @@ AP_DECLARE(void) ap_clear_method_list(ap_method_list_t *l); + */ + AP_DECLARE(void) ap_set_content_type(request_rec *r, const char *ct); + ++/** ++ * Set the content type for this request (r->content_type). ++ * @param r The current request ++ * @param ct The new content type ++ * @param trusted If non-zero, The content-type should come from a ++ * trusted source such as server configuration rather ++ * than application output. ++ * for the AddOutputFilterByType directive to work correctly. ++ */ ++AP_DECLARE(void) ap_set_content_type_ex(request_rec *r, const char *ct, int trusted); ++ + /** + * Set the Accept-Ranges header for this response + * @param r The current request +diff --git a/include/httpd.h b/include/httpd.h +index 1549be0..61e02a9 100644 +--- a/include/httpd.h ++++ b/include/httpd.h +@@ -667,6 +667,7 @@ typedef apr_uint64_t ap_request_bnotes_t; + * + */ + #define AP_REQUEST_STRONG_ETAG 1 >> 0 ++#define AP_REQUEST_TRUSTED_CT 1 << 1 + + /** + * This is a convenience macro to ease with getting specific request +@@ -689,6 +690,12 @@ typedef apr_uint64_t ap_request_bnotes_t; + AP_REQUEST_GET_BNOTE((r), AP_REQUEST_STRONG_ETAG) + /** @} */ + ++/** ++ * Returns true if the content-type field is from a trusted source ++ */ ++#define AP_REQUEST_IS_TRUSTED_CT(r) \ ++ (!!AP_REQUEST_GET_BNOTE((r), AP_REQUEST_TRUSTED_CT)) ++/** @} */ + + /** + * @defgroup module_magic Module Magic mime types +diff --git a/modules/http/http_protocol.c b/modules/http/http_protocol.c +index d031f24..c31e873 100644 +--- a/modules/http/http_protocol.c ++++ b/modules/http/http_protocol.c +@@ -1097,8 +1097,14 @@ AP_DECLARE(void) ap_set_content_type(request_rec *r, const char *ct) + } + else if (!r->content_type || strcmp(r->content_type, ct)) { + r->content_type = ct; ++ AP_REQUEST_SET_BNOTE(r, AP_REQUEST_TRUSTED_CT, 0); + } + } ++AP_DECLARE(void) ap_set_content_type_ex(request_rec *r, const char *ct, int trusted) ++{ ++ ap_set_content_type(r, ct); ++ AP_REQUEST_SET_BNOTE(r, AP_REQUEST_TRUSTED_CT, trusted ? AP_REQUEST_TRUSTED_CT : 0); ++} + + AP_DECLARE(void) ap_set_accept_ranges(request_rec *r) + { +diff --git a/modules/http/mod_mime.c b/modules/http/mod_mime.c +index 700f824..51095a0 100644 +--- a/modules/http/mod_mime.c ++++ b/modules/http/mod_mime.c +@@ -759,7 +759,7 @@ static int find_ct(request_rec *r) + int found_metadata = 0; + + if (r->finfo.filetype == APR_DIR) { +- ap_set_content_type(r, DIR_MAGIC_TYPE); ++ ap_set_content_type_ex(r, DIR_MAGIC_TYPE, 1); + return OK; + } + +@@ -850,7 +850,7 @@ static int find_ct(request_rec *r) + if (exinfo == NULL || !exinfo->forced_type) { + if ((type = apr_hash_get(mime_type_extensions, ext, + APR_HASH_KEY_STRING)) != NULL) { +- ap_set_content_type(r, (char*) type); ++ ap_set_content_type_ex(r, (char*) type, 1); + found = 1; + } + } +@@ -859,7 +859,7 @@ static int find_ct(request_rec *r) + + /* empty string is treated as special case for RemoveType */ + if (exinfo->forced_type && *exinfo->forced_type) { +- ap_set_content_type(r, exinfo->forced_type); ++ ap_set_content_type_ex(r, exinfo->forced_type, 1); + found = 1; + } + +@@ -964,33 +964,33 @@ static int find_ct(request_rec *r) + memcpy(tmp, ctp->subtype, ctp->subtype_len); + tmp += ctp->subtype_len; + *tmp = 0; +- ap_set_content_type(r, base_content_type); ++ ap_set_content_type_ex(r, base_content_type, AP_REQUEST_IS_TRUSTED_CT(r)); + while (pp != NULL) { + if (charset && !strcmp(pp->attr, "charset")) { + if (!override) { +- ap_set_content_type(r, ++ ap_set_content_type_ex(r, + apr_pstrcat(r->pool, + r->content_type, + "; charset=", + charset, +- NULL)); ++ NULL), AP_REQUEST_IS_TRUSTED_CT(r)); + override = 1; + } + } + else { +- ap_set_content_type(r, ++ ap_set_content_type_ex(r, + apr_pstrcat(r->pool, + r->content_type, + "; ", pp->attr, + "=", pp->val, +- NULL)); ++ NULL), AP_REQUEST_IS_TRUSTED_CT(r)); + } + pp = pp->next; + } + if (charset && !override) { +- ap_set_content_type(r, apr_pstrcat(r->pool, r->content_type, ++ ap_set_content_type_ex(r, apr_pstrcat(r->pool, r->content_type, + "; charset=", charset, +- NULL)); ++ NULL), AP_REQUEST_IS_TRUSTED_CT(r)); + } + } + } +diff --git a/modules/mappers/mod_actions.c b/modules/mappers/mod_actions.c +index ac9c3b7..5e398b5 100644 +--- a/modules/mappers/mod_actions.c ++++ b/modules/mappers/mod_actions.c +@@ -182,8 +182,10 @@ static int action_handler(request_rec *r) + return DECLINED; + + /* Second, check for actions (which override the method scripts) */ +- action = r->handler ? r->handler : +- ap_field_noparam(r->pool, r->content_type); ++ action = r->handler; ++ if (!action && AP_REQUEST_IS_TRUSTED_CT(r)) { ++ action = ap_field_noparam(r->pool, r->content_type); ++ } + + if (action && (t = apr_table_get(conf->action_types, action))) { + int virtual = (*t++ == '0' ? 0 : 1); +diff --git a/modules/mappers/mod_negotiation.c b/modules/mappers/mod_negotiation.c +index c056b28..a528f81 100644 +--- a/modules/mappers/mod_negotiation.c ++++ b/modules/mappers/mod_negotiation.c +@@ -1167,7 +1167,7 @@ static int read_types_multi(negotiation_state *neg) + * might be doing. + */ + if (sub_req->handler && !sub_req->content_type) { +- ap_set_content_type(sub_req, CGI_MAGIC_TYPE); ++ ap_set_content_type_ex(sub_req, CGI_MAGIC_TYPE, 1); + } + + /* +@@ -3003,14 +3003,14 @@ static int handle_map_file(request_rec *r) + /* set MIME type and charset as negotiated */ + if (best->mime_type && *best->mime_type) { + if (best->content_charset && *best->content_charset) { +- ap_set_content_type(r, apr_pstrcat(r->pool, ++ ap_set_content_type_ex(r, apr_pstrcat(r->pool, + best->mime_type, + "; charset=", + best->content_charset, +- NULL)); ++ NULL), 1); + } + else { +- ap_set_content_type(r, apr_pstrdup(r->pool, best->mime_type)); ++ ap_set_content_type_ex(r, apr_pstrdup(r->pool, best->mime_type), 1); + } + } + +diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c +index 024808b..78847f9 100644 +--- a/modules/mappers/mod_rewrite.c ++++ b/modules/mappers/mod_rewrite.c +@@ -5454,7 +5454,7 @@ static int hook_mimetype(request_rec *r) + rewritelog((r, 1, NULL, "force filename %s to have MIME-type '%s'", + r->filename, t)); + +- ap_set_content_type(r, t); ++ ap_set_content_type_ex(r, t, 1); + } + + /* handler */ +diff --git a/modules/metadata/mod_headers.c b/modules/metadata/mod_headers.c +index ef812cd..4838bd6 100644 +--- a/modules/metadata/mod_headers.c ++++ b/modules/metadata/mod_headers.c +@@ -783,14 +783,14 @@ static int do_headers_fixup(request_rec *r, apr_table_t *headers, + break; + case hdr_set: + if (!ap_cstr_casecmp(hdr->header, "Content-Type")) { +- ap_set_content_type(r, process_tags(hdr, r)); ++ ap_set_content_type_ex(r, process_tags(hdr, r), 1); + } + apr_table_setn(headers, hdr->header, process_tags(hdr, r)); + break; + case hdr_setifempty: + if (NULL == apr_table_get(headers, hdr->header)) { + if (!ap_cstr_casecmp(hdr->header, "Content-Type")) { +- ap_set_content_type(r, process_tags(hdr, r)); ++ ap_set_content_type_ex(r, process_tags(hdr, r), 1); + } + apr_table_setn(headers, hdr->header, process_tags(hdr, r)); + } +@@ -809,7 +809,7 @@ static int do_headers_fixup(request_rec *r, apr_table_t *headers, + const char *repl = process_regexp(hdr, r->content_type, r); + if (repl == NULL) + return 0; +- ap_set_content_type(r, repl); ++ ap_set_content_type_ex(r, repl, 1); + } + if (apr_table_get(headers, hdr->header)) { + edit_do ed; +diff --git a/modules/metadata/mod_mime_magic.c b/modules/metadata/mod_mime_magic.c +index 7dac4fd..1c96db4 100644 +--- a/modules/metadata/mod_mime_magic.c ++++ b/modules/metadata/mod_mime_magic.c +@@ -788,7 +788,7 @@ static int magic_rsl_to_request(request_rec *r) + /* XXX: this could be done at config time I'm sure... but I'm + * confused by all this magic_rsl stuff. -djg */ + ap_content_type_tolower(tmp); +- ap_set_content_type(r, tmp); ++ ap_set_content_type_ex(r, tmp, 1); + + if (state == rsl_encoding) { + tmp = rsl_strdup(r, encoding_frag, +@@ -2326,7 +2326,7 @@ static int revision_suffix(request_rec *r) + + /* extract content type/encoding/language from sub-request */ + if (sub->content_type) { +- ap_set_content_type(r, apr_pstrdup(r->pool, sub->content_type)); ++ ap_set_content_type_ex(r, apr_pstrdup(r->pool, sub->content_type), 1); + #if MIME_MAGIC_DEBUG + ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(01557) + MODNAME ": subrequest %s got %s", +diff --git a/server/config.c b/server/config.c +index 3d11ff5..635b65d 100644 +--- a/server/config.c ++++ b/server/config.c +@@ -418,7 +418,7 @@ AP_CORE_DECLARE(int) ap_invoke_handler(request_rec *r) + } + + if (!r->handler) { +- if (r->content_type) { ++ if (r->content_type && AP_REQUEST_IS_TRUSTED_CT(r)) { + handler = r->content_type; + if ((p=ap_strchr_c(handler, ';')) != NULL) { + char *new_handler = (char *)apr_pmemdup(r->pool, handler, +diff --git a/server/core.c b/server/core.c +index ffe5d16..b19763b 100644 +--- a/server/core.c ++++ b/server/core.c +@@ -4816,7 +4816,7 @@ static int core_override_type(request_rec *r) + /* Check for overrides with ForceType / SetHandler + */ + if (conf->mime_type && strcmp(conf->mime_type, "none")) +- ap_set_content_type(r, (char*) conf->mime_type); ++ ap_set_content_type_ex(r, (char*) conf->mime_type, 1); + + if (conf->expr_handler) { + const char *err; +-- +2.33.0 + diff --git a/backport-CVE-2024-38477-validate-hostsname.patch b/backport-CVE-2024-38477-validate-hostsname.patch new file mode 100644 index 0000000000000000000000000000000000000000..b88ed325d461fd19ebf7127ea90bf22fae5772ea --- /dev/null +++ b/backport-CVE-2024-38477-validate-hostsname.patch @@ -0,0 +1,50 @@ +From 1d98d4db186e708f059336fb9342d0adb6925e85 Mon Sep 17 00:00:00 2001 +From: Eric Covener +Date: Tue, 25 Jun 2024 17:29:32 +0000 +Subject: [PATCH] Merge r1918606 from trunk: + +validate hostname + + + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918607 13f79535-47bb-0310-9956-ffa450edef68 + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/1d98d4db186e708f059336fb9342d0adb6925e85 + +--- + modules/proxy/proxy_util.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c +index 541e944..3b174ad 100644 +--- a/modules/proxy/proxy_util.c ++++ b/modules/proxy/proxy_util.c +@@ -2627,6 +2627,13 @@ ap_proxy_determine_connection(apr_pool_t *p, request_rec *r, + apr_pstrcat(p,"URI cannot be parsed: ", *url, + NULL)); + } ++ ++ if (!uri->hostname) { ++ return ap_proxyerror(r, HTTP_BAD_REQUEST, ++ apr_pstrcat(p,"URI has no hostname: ", *url, ++ NULL)); ++ } ++ + if (!uri->port) { + uri->port = ap_proxy_port_of_scheme(uri->scheme); + } +@@ -3992,6 +3999,10 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p, + + /* Compute Host header */ + if (dconf->preserve_host == 0) { ++ if (!uri->hostname) { ++ rc = HTTP_BAD_REQUEST; ++ goto cleanup; ++ } + if (ap_strchr_c(uri->hostname, ':')) { /* if literal IPv6 address */ + if (uri->port_str && uri->port != DEFAULT_HTTP_PORT) { + host = apr_pstrcat(r->pool, "[", uri->hostname, "]:", +-- +2.33.0 + diff --git a/backport-CVE-2024-39884-maintain-trusted-flag.patch b/backport-CVE-2024-39884-maintain-trusted-flag.patch new file mode 100644 index 0000000000000000000000000000000000000000..38c1acbdad68d934791e9b90b6cc3afee700f257 --- /dev/null +++ b/backport-CVE-2024-39884-maintain-trusted-flag.patch @@ -0,0 +1,309 @@ +From fe171ffdf85cdfc3f6f44e8dd0ee3d5e3e6a0d1d Mon Sep 17 00:00:00 2001 +From: Eric Covener +Date: Tue, 2 Jul 2024 13:07:17 +0000 +Subject: [PATCH] Merge r1918795, r1918814 from trunk: + +maintain trusted flag + + +* Always trust content types that we set literally + +Submitted by: covener, rpluem +Reviewed by: covener, jorton, rpluem + +Github: closes #459 + + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1918839 13f79535-47bb-0310-9956-ffa450edef68 + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/fe171ffdf85cdfc3f6f44e8dd0ee3d5e3e6a0d1d + +--- + modules/cluster/mod_heartmonitor.c | 2 +- + modules/dav/main/mod_dav.c | 10 +++++----- + modules/examples/mod_example_hooks.c | 2 +- + modules/filters/mod_data.c | 2 +- + modules/filters/mod_include.c | 2 +- + modules/filters/mod_proxy_html.c | 4 ++-- + modules/generators/mod_cgi.c | 2 +- + modules/generators/mod_cgid.c | 2 +- + modules/generators/mod_info.c | 2 +- + modules/generators/mod_status.c | 4 ++-- + modules/http/http_filters.c | 2 +- + modules/http/http_protocol.c | 4 ++-- + modules/http/http_request.c | 2 +- + modules/ldap/util_ldap.c | 2 +- + modules/mappers/mod_imagemap.c | 2 +- + modules/proxy/mod_proxy_balancer.c | 2 +- + 16 files changed, 23 insertions(+), 23 deletions(-) + +diff --git a/modules/cluster/mod_heartmonitor.c b/modules/cluster/mod_heartmonitor.c +index 53b6504..68db585 100644 +--- a/modules/cluster/mod_heartmonitor.c ++++ b/modules/cluster/mod_heartmonitor.c +@@ -782,7 +782,7 @@ static int hm_handler(request_rec *r) + hmserver.seen = apr_time_now(); + hm_update_stat(ctx, &hmserver, r->pool); + +- ap_set_content_type(r, "text/plain"); ++ ap_set_content_type_ex(r, "text/plain", 1); + ap_set_content_length(r, 2); + ap_rputs("OK", r); + ap_rflush(r); +diff --git a/modules/dav/main/mod_dav.c b/modules/dav/main/mod_dav.c +index a035f25..8b92de2 100644 +--- a/modules/dav/main/mod_dav.c ++++ b/modules/dav/main/mod_dav.c +@@ -355,7 +355,7 @@ static int dav_error_response(request_rec *r, int status, const char *body) + r->status = status; + r->status_line = ap_get_status_line(status); + +- ap_set_content_type(r, "text/html; charset=ISO-8859-1"); ++ ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1); + + /* begin the response now... */ + ap_rvputs(r, +@@ -386,7 +386,7 @@ static int dav_error_response_tag(request_rec *r, + { + r->status = err->status; + +- ap_set_content_type(r, DAV_XML_CONTENT_TYPE); ++ ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1); + + ap_rputs(DAV_XML_HEADER DEBUG_CR + "status = status; +- ap_set_content_type(r, DAV_XML_CONTENT_TYPE); ++ ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1); + + /* Send the headers and actual multistatus response now... */ + ap_fputs(r->output_filters, bb, DAV_XML_HEADER DEBUG_CR +@@ -2016,7 +2016,7 @@ static int dav_method_options(request_rec *r) + + /* send the options response */ + r->status = HTTP_OK; +- ap_set_content_type(r, DAV_XML_CONTENT_TYPE); ++ ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1); + + /* send the headers and response body */ + ap_rputs(DAV_XML_HEADER DEBUG_CR +@@ -3328,7 +3328,7 @@ static int dav_method_lock(request_rec *r) + (*locks_hooks->close_lockdb)(lockdb); + + r->status = HTTP_OK; +- ap_set_content_type(r, DAV_XML_CONTENT_TYPE); ++ ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1); + + ap_rputs(DAV_XML_HEADER DEBUG_CR "" DEBUG_CR, r); + if (lock == NULL) +diff --git a/modules/examples/mod_example_hooks.c b/modules/examples/mod_example_hooks.c +index f7ef5a5..d937906 100644 +--- a/modules/examples/mod_example_hooks.c ++++ b/modules/examples/mod_example_hooks.c +@@ -993,7 +993,7 @@ static int x_handler(request_rec *r) + * Set the Content-type header. Note that we do not actually have to send + * the headers: this is done by the http core. + */ +- ap_set_content_type(r, "text/html"); ++ ap_set_content_type_ex(r, "text/html", 1); + /* + * If we're only supposed to send header information (HEAD request), we're + * already there. +diff --git a/modules/filters/mod_data.c b/modules/filters/mod_data.c +index ddadd1b..4e6e636 100644 +--- a/modules/filters/mod_data.c ++++ b/modules/filters/mod_data.c +@@ -117,7 +117,7 @@ static apr_status_t data_out_filter(ap_filter_t *f, apr_bucket_brigade *bb) + } + } + +- ap_set_content_type(r, "text/plain"); ++ ap_set_content_type_ex(r, "text/plain", 1); + + } + +diff --git a/modules/filters/mod_include.c b/modules/filters/mod_include.c +index 584d8fb..2c0cc67 100644 +--- a/modules/filters/mod_include.c ++++ b/modules/filters/mod_include.c +@@ -3972,7 +3972,7 @@ static int include_fixup(request_rec *r) + if (r->handler && (strcmp(r->handler, "server-parsed") == 0)) + { + if (!r->content_type || !*r->content_type) { +- ap_set_content_type(r, "text/html"); ++ ap_set_content_type_ex(r, "text/html", 1); + } + r->handler = "default-handler"; + } +diff --git a/modules/filters/mod_proxy_html.c b/modules/filters/mod_proxy_html.c +index 7783da1..4205a61 100644 +--- a/modules/filters/mod_proxy_html.c ++++ b/modules/filters/mod_proxy_html.c +@@ -952,7 +952,7 @@ static apr_status_t proxy_html_filter(ap_filter_t *f, apr_bucket_brigade *bb) + ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, f->r, APLOGNO(01422) + "No i18n support found. Install mod_xml2enc if required"); + enc = XML_CHAR_ENCODING_NONE; +- ap_set_content_type(f->r, "text/html;charset=utf-8"); ++ ap_set_content_type_ex(f->r, "text/html;charset=utf-8", 1); + } + else { + /* if we wanted a non-default charset_out, insert the +@@ -968,7 +968,7 @@ static apr_status_t proxy_html_filter(ap_filter_t *f, apr_bucket_brigade *bb) + cenc, NULL)); + } + else /* Normal case, everything worked, utf-8 output */ +- ap_set_content_type(f->r, "text/html;charset=utf-8"); ++ ap_set_content_type_ex(f->r, "text/html;charset=utf-8", 1); + } + + ap_fputs(f->next, ctxt->bb, ctxt->cfg->doctype); +diff --git a/modules/generators/mod_cgi.c b/modules/generators/mod_cgi.c +index 421124a..7d6cba9 100644 +--- a/modules/generators/mod_cgi.c ++++ b/modules/generators/mod_cgi.c +@@ -672,7 +672,7 @@ static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f, + /* Force sub_req to be treated as a CGI request, even if ordinary + * typing rules would have called it something else. + */ +- ap_set_content_type(rr, CGI_MAGIC_TYPE); ++ ap_set_content_type_ex(rr, CGI_MAGIC_TYPE, 1); + + /* Run it. */ + rr_status = ap_run_sub_req(rr); +diff --git a/modules/generators/mod_cgid.c b/modules/generators/mod_cgid.c +index dddfb25..3690957 100644 +--- a/modules/generators/mod_cgid.c ++++ b/modules/generators/mod_cgid.c +@@ -1667,7 +1667,7 @@ static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f, + /* Force sub_req to be treated as a CGI request, even if ordinary + * typing rules would have called it something else. + */ +- ap_set_content_type(rr, CGI_MAGIC_TYPE); ++ ap_set_content_type_ex(rr, CGI_MAGIC_TYPE, 1); + + /* Run it. */ + rr_status = ap_run_sub_req(rr); +diff --git a/modules/generators/mod_info.c b/modules/generators/mod_info.c +index 1662242..a94e4e4 100644 +--- a/modules/generators/mod_info.c ++++ b/modules/generators/mod_info.c +@@ -784,7 +784,7 @@ static int display_info(request_rec * r) + return DECLINED; + } + +- ap_set_content_type(r, "text/html; charset=ISO-8859-1"); ++ ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1); + + ap_rputs(DOCTYPE_XHTML_1_0T + "\n" +diff --git a/modules/generators/mod_status.c b/modules/generators/mod_status.c +index 5bada07..2cb38c7 100644 +--- a/modules/generators/mod_status.c ++++ b/modules/generators/mod_status.c +@@ -273,7 +273,7 @@ static int status_handler(request_rec *r) + if (r->method_number != M_GET) + return DECLINED; + +- ap_set_content_type(r, "text/html; charset=ISO-8859-1"); ++ ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1); + + /* + * Simple table-driven form data set parser that lets you alter the header +@@ -301,7 +301,7 @@ static int status_handler(request_rec *r) + no_table_report = 1; + break; + case STAT_OPT_AUTO: +- ap_set_content_type(r, "text/plain; charset=ISO-8859-1"); ++ ap_set_content_type_ex(r, "text/plain; charset=ISO-8859-1", 1); + short_report = 1; + break; + } +diff --git a/modules/http/http_filters.c b/modules/http/http_filters.c +index f20aee7..60b44d7 100644 +--- a/modules/http/http_filters.c ++++ b/modules/http/http_filters.c +@@ -1261,7 +1261,7 @@ AP_DECLARE_NONSTD(int) ap_send_http_trace(request_rec *r) + } + } + +- ap_set_content_type(r, "message/http"); ++ ap_set_content_type_ex(r, "message/http", 1); + + /* Now we recreate the request, and echo it back */ + +diff --git a/modules/http/http_protocol.c b/modules/http/http_protocol.c +index c31e873..3bc666e 100644 +--- a/modules/http/http_protocol.c ++++ b/modules/http/http_protocol.c +@@ -1443,10 +1443,10 @@ AP_DECLARE(void) ap_send_error_response(request_rec *r, int recursive_error) + request_conf->suppress_charset = 1; /* avoid adding default + * charset later + */ +- ap_set_content_type(r, "text/html"); ++ ap_set_content_type_ex(r, "text/html", 1); + } + else { +- ap_set_content_type(r, "text/html; charset=iso-8859-1"); ++ ap_set_content_type_ex(r, "text/html; charset=iso-8859-1", 1); + } + + if ((status == HTTP_METHOD_NOT_ALLOWED) +diff --git a/modules/http/http_request.c b/modules/http/http_request.c +index d59cfe2..71ecc2b 100644 +--- a/modules/http/http_request.c ++++ b/modules/http/http_request.c +@@ -708,7 +708,7 @@ AP_DECLARE(void) ap_internal_fast_redirect(request_rec *rr, request_rec *r) + r->args = rr->args; + r->finfo = rr->finfo; + r->handler = rr->handler; +- ap_set_content_type(r, rr->content_type); ++ ap_set_content_type_ex(r, rr->content_type, AP_REQUEST_IS_TRUSTED_CT(r)); + r->content_encoding = rr->content_encoding; + r->content_languages = rr->content_languages; + r->per_dir_config = rr->per_dir_config; +diff --git a/modules/ldap/util_ldap.c b/modules/ldap/util_ldap.c +index aa0bad1..8c9e587 100644 +--- a/modules/ldap/util_ldap.c ++++ b/modules/ldap/util_ldap.c +@@ -171,7 +171,7 @@ static int util_ldap_handler(request_rec *r) + st = (util_ldap_state_t *) ap_get_module_config(r->server->module_config, + &ldap_module); + +- ap_set_content_type(r, "text/html; charset=ISO-8859-1"); ++ ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1); + + if (r->header_only) + return OK; +diff --git a/modules/mappers/mod_imagemap.c b/modules/mappers/mod_imagemap.c +index 206c0b6..b2dca7e 100644 +--- a/modules/mappers/mod_imagemap.c ++++ b/modules/mappers/mod_imagemap.c +@@ -475,7 +475,7 @@ static int imap_reply(request_rec *r, const char *redirect) + + static void menu_header(request_rec *r, char *menu) + { +- ap_set_content_type(r, "text/html; charset=ISO-8859-1"); ++ ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1); + + ap_rvputs(r, DOCTYPE_HTML_3_2, "\nMenu for ", + ap_escape_html(r->pool, r->uri), +diff --git a/modules/proxy/mod_proxy_balancer.c b/modules/proxy/mod_proxy_balancer.c +index b8b452d..3c0f5a8 100644 +--- a/modules/proxy/mod_proxy_balancer.c ++++ b/modules/proxy/mod_proxy_balancer.c +@@ -1471,7 +1471,7 @@ static void balancer_display_page(request_rec *r, proxy_server_conf *conf, + + if (usexml) { + char date[APR_RFC822_DATE_LEN]; +- ap_set_content_type(r, "text/xml"); ++ ap_set_content_type_ex(r, "text/xml", 1); + ap_rputs("<?xml version='1.0' encoding='UTF-8' ?>\n", r); + ap_rputs("<httpd:manager xmlns:httpd='http://httpd.apache.org'>\n", r); + ap_rputs(" <httpd:balancers>\n", r); +-- +2.33.0 + diff --git a/httpd.spec b/httpd.spec index db1cbd78aaa8e6ae6f18c02502f3f8e1bd4db351..6655231b69005903efc2fc281ed8dd4ce25ab4c1 100644 --- a/httpd.spec +++ b/httpd.spec @@ -8,7 +8,7 @@ Name: httpd Summary: Apache HTTP Server Version: 2.4.58 -Release: 5 +Release: 6 License: ASL 2.0 URL: https://httpd.apache.org/ Source0: https://archive.apache.org/dist/httpd/httpd-%{version}.tar.bz2 @@ -78,6 +78,15 @@ Patch24: backport-CVE-2024-27316-bail-after-too-many-failed-reads.patch Patch25: backport-remove-dependency-on-xmlstring-header.patch Patch26: backport-only-allocate-a-heap-heap-buffer.patch Patch27: backport-CVE-2024-36387-mod_http2-early-exit-if-bb-is-null.patch +Patch28: backport-CVE-2024-38473-mod_proxy-escape-for-non-proxypass-configuration.patch +Patch29: backport-CVE-2024-38473-mod_proxy-Fixup-UDS-filename.patch +Patch30: backport-CVE-2024-38473-CVE-2024-39573-block-inadvertent-subst-of-special-filename.patch +Patch31: backport-CVE-2024-38473-fix-comparsion-of-local-path.patch +Patch32: backport-CVE-2024-38473-fix-the-filename-redirected.patch +Patch33: backport-CVE-2024-38474-CVE-2024-38475-tighten-up-prefix_stat.patch +Patch34: backport-CVE-2024-38476-add-ap_set_content_type_ex-to-differentiate-trusted-sources.patch +Patch35: backport-CVE-2024-38477-validate-hostsname.patch +Patch36: backport-CVE-2024-39884-maintain-trusted-flag.patch BuildRequires: gcc autoconf pkgconfig findutils xmlto perl-interpreter perl-generators systemd-devel BuildRequires: zlib-devel libselinux-devel lua-devel brotli-devel @@ -515,6 +524,12 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Mon Jul 08 2024 chengyechun <chengyechun1@huawei.com> - 2.4.58-6 +- Type:CVE +- ID:CVE-2024-38473,CVE-2024-38474,CVE-2024-38475,CVE-2024-38476,CVE-2024-38477,CVE-2024-39884,CVE-2024-39573 +- SUG:NA +- DSEC:fix some CVEs + * Tue Jul 02 2024 wangziliang <wangziliang@kylinos.cn> - 2.4.58-5 - Type:CVE - ID:CVE-2024-36387