rpms/httpd
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Resolves: RHEL-190819 - httpd: Apache HTTP Server: Arbitrary code

Browse Source 
execution or denial of service via use-after-free in mod_ldap per-directory
  configuration (CVE-2026-29167)
This commit is contained in:
Luboš Uhliarik 2026-08-25 11:08:23 +02:00
parent 0bb1dcc715
commit 27603cd4d7
2 changed files with 54 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

46
httpd-2.4.63-CVE-2026-29167.patch Normal file
View File

@ -0,0 +1,46 @@
From 88568e901f41fdd527d180970f7f372f88b93260 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@apache.org>
Date: Wed, 3 Jun 2026 17:09:40 +0000
Subject: [PATCH] Merge r1934932 from trunk:
* modules/ldap/util_ldap.c (uldap_connection_find): Fix inheritance in
per-dir context.
Reviewed by: jorton, covener, jfclere
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1934935 13f79535-47bb-0310-9956-ffa450edef68
---
modules/ldap/util_ldap.c | 19 +++++++++++++++++--
1 file changed, 17 insertions(+), 2 deletions(-)
diff --git a/modules/ldap/util_ldap.c b/modules/ldap/util_ldap.c
index 8c9e58717d..0f13d912c3 100644
--- a/modules/ldap/util_ldap.c
+++ b/modules/ldap/util_ldap.c
@@ -897,8 +897,23 @@ static util_ldap_connection_t *
*/
l->secure = secureflag;
- /* save away a copy of the client cert list that is presently valid */
- l->client_certs = apr_array_copy_hdr(l->pool, dc->client_certs);
+ /* Deep-copy the client cert list into the connection pool so that
+ * the cached connection does not retain pointers into the
+ * (potentially short-lived) per-directory config pool.
+ */
+ l->client_certs = apr_array_copy(l->pool, dc->client_certs);
+ if (!apr_is_empty_array(l->client_certs)) {
+ int i;
+ apr_ldap_opt_tls_cert_t *certs;
+
+ certs = (apr_ldap_opt_tls_cert_t *)l->client_certs->elts;
+ for (i = 0; i < l->client_certs->nelts; i++) {
+ if (certs[i].path)
+ certs[i].path = apr_pstrdup(l->pool, certs[i].path);
+ if (certs[i].password)
+ certs[i].password = apr_pstrdup(l->pool, certs[i].password);
+ }
+ }
/* whether or not to keep this connection in the pool when it's returned */
l->keep = (st->connection_pool_ttl == 0) ? 0 : 1;

9
httpd.spec
View File

@ -25,7 +25,7 @@
Summary: Apache HTTP Server
Name: httpd
Version: 2.4.63
Release: 15%{?dist}
Release: 16%{?dist}
URL: https://httpd.apache.org/
Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@ -164,6 +164,8 @@ Patch221: httpd-2.4.63-CVE-2026-42535.patch
Patch222: httpd-2.4.63-CVE-2026-24072.patch
Patch223: httpd-2.4.63-CVE-2026-33006.patch
Patch224: httpd-2.4.63-CVE-2026-44186.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=2486394
Patch225: httpd-2.4.63-CVE-2026-29167.patch
# Apache-2.0: everything
# BSD-3-Clause: util_pcre.c, ap_regex.h
@ -885,6 +887,11 @@ exit $rv
%{_rpmconfigdir}/macros.d/macros.httpd
%changelog
* Tue Aug 25 2026 Luboš Uhliarik <luhliari@redhat.com> - 2.4.63-16
- Resolves: RHEL-190819 - httpd: Apache HTTP Server: Arbitrary code
execution or denial of service via use-after-free in mod_ldap per-directory
configuration (CVE-2026-29167)
* Tue Aug 18 2026 Luboš Uhliarik <luhliari@redhat.com> - 2.4.63-15
- Resolves: RHEL-186222 - httpd: Apache HTTP Server: Heap-based Buffer Overflow
via malicious backend servers (CVE-2026-34356)