+
Available Languages: en |
+diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
+index b71c67c..797f093 100644
+--- a/modules/mappers/mod_rewrite.c
++++ b/modules/mappers/mod_rewrite.c
+@@ -172,6 +172,8 @@ static const char* really_last_key = "rewrite_really_last";
+ #define RULEFLAG_QSLAST (1<<19)
+ #define RULEFLAG_QSNONE (1<<20) /* programattic only */
+ #define RULEFLAG_ESCAPECTLS (1<<21)
++#define RULEFLAG_UNSAFE_PREFIX_STAT (1<<22)
++#define RULEFLAG_UNSAFE_ALLOW3F (1<<23)
+
+ /* return code of the rewrite rule
+ * the result may be escaped - or not
+@@ -179,7 +181,7 @@ static const char* really_last_key = "rewrite_really_last";
+ #define ACTION_NORMAL (1<<0)
+ #define ACTION_NOESCAPE (1<<1)
+ #define ACTION_STATUS (1<<2)
+-
++#define ACTION_STATUS_SET (1<<3)
+
+ #define MAPTYPE_TXT (1<<0)
+ #define MAPTYPE_DBM (1<<1)
+@@ -203,6 +205,7 @@ static const char* really_last_key = "rewrite_really_last";
+ #define OPTION_IGNORE_INHERIT (1<<8)
+ #define OPTION_IGNORE_CONTEXT_INFO (1<<9)
+ #define OPTION_LEGACY_PREFIX_DOCROOT (1<<10)
++#define OPTION_UNSAFE_PREFIX_STAT (1<<12)
+
+ #ifndef RAND_MAX
+ #define RAND_MAX 32767
+@@ -296,6 +299,14 @@ typedef enum {
+ CONDPAT_AP_EXPR
+ } pattern_type;
+
++typedef enum {
++ RULE_RC_NOMATCH = 0, /* the rule didn't match */
++ RULE_RC_MATCH = 1, /* a matching rule w/ substitution */
++ RULE_RC_NOSUB = 2, /* a matching rule w/ no substitution */
++ RULE_RC_STATUS_SET = 3 /* a matching rule that has set an HTTP error
++ to be returned in r->status */
++} rule_return_type;
++
+ typedef struct {
+ char *input; /* Input string of RewriteCond */
+ char *pattern; /* the RegExp pattern string */
+@@ -927,10 +938,15 @@ static void fully_qualify_uri(request_rec *r)
+ return;
+ }
+
++static int startsWith(request_rec *r, const char *haystack, const char *needle) {
++ int rc = (ap_strstr_c(haystack, needle) == haystack);
++ rewritelog((r, 5, NULL, "prefix_stat startsWith(%s, %s) %d", haystack, needle, rc));
++ return rc;
++}
+ /*
+- * stat() only the first segment of a path
++ * stat() only the first segment of a path, and only if it matches the output of the last matching rule
+ */
+-static int prefix_stat(const char *path, apr_pool_t *pool)
++static int prefix_stat(request_rec *r, const char *path, apr_pool_t *pool, rewriterule_entry *lastsub)
+ {
+ const char *curpath = path;
+ const char *root;
+@@ -964,10 +980,36 @@ static int prefix_stat(const char *path, apr_pool_t *pool)
+ apr_finfo_t sb;
+
+ if (apr_stat(&sb, statpath, APR_FINFO_MIN, pool) == APR_SUCCESS) {
+- return 1;
++ if (!lastsub) {
++ rewritelog((r, 3, NULL, "prefix_stat no lastsub subst prefix %s", statpath));
++ return 1;
++ }
++
++ rewritelog((r, 3, NULL, "prefix_stat compare statpath %s and lastsub output %s STATOK %d ",
++ statpath, lastsub->output, lastsub->flags & RULEFLAG_UNSAFE_PREFIX_STAT));
++ if (lastsub->flags & RULEFLAG_UNSAFE_PREFIX_STAT) {
++ return 1;
++ }
++ else {
++ const char *docroot = ap_document_root(r);
++ const char *context_docroot = ap_context_document_root(r);
++ /*
++ * As an example, path (r->filename) is /var/foo/bar/baz.html
++ * even if the flag is not set, we can accept a rule that
++ * began with a literal /var (stapath), or if the entire path
++ * starts with the docroot or context document root
++ */
++ if (startsWith(r, lastsub->output, statpath) ||
++ startsWith(r, path, docroot) ||
++ ((docroot != context_docroot) &&
++ startsWith(r, path, context_docroot))) {
++ return 1;
++ }
++ }
+ }
+ }
+
++ /* prefix will be added */
+ return 0;
+ }
+
+@@ -3046,6 +3088,9 @@ static const char *cmd_rewriteoptions(cmd_parms *cmd,
+ else if (!strcasecmp(w, "legacyprefixdocroot")) {
+ options |= OPTION_LEGACY_PREFIX_DOCROOT;
+ }
++ else if (!strcasecmp(w, "UnsafePrefixStat")) {
++ options |= OPTION_UNSAFE_PREFIX_STAT;
++ }
+ else {
+ return apr_pstrcat(cmd->pool, "RewriteOptions: unknown option '",
+ w, "'", NULL);
+@@ -3752,6 +3797,18 @@ static const char *cmd_rewriterule_setflag(apr_pool_t *p, void *_cfg,
+ ++error;
+ }
+ break;
++ case 'u':
++ case 'U':
++ if (!strcasecmp(key, "nsafePrefixStat")){
++ cfg->flags |= (RULEFLAG_UNSAFE_PREFIX_STAT);
++ }
++ else if(!strcasecmp(key, "nsafeAllow3F")) {
++ cfg->flags |= RULEFLAG_UNSAFE_ALLOW3F;
++ }
++ else {
++ ++error;
++ }
++ break;
+ default:
+ ++error;
+ break;
+@@ -4102,7 +4159,8 @@ static APR_INLINE void force_type_handler(rewriterule_entry *p,
+ /*
+ * Apply a single RewriteRule
+ */
+-static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
++static rule_return_type apply_rewrite_rule(rewriterule_entry *p,
++ rewrite_ctx *ctx)
+ {
+ ap_regmatch_t regmatch[AP_MAX_REG_MATCH];
+ apr_array_header_t *rewriteconds;
+@@ -4153,7 +4211,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+ rc = !ap_regexec(p->regexp, ctx->uri, AP_MAX_REG_MATCH, regmatch, 0);
+ if (! (( rc && !(p->flags & RULEFLAG_NOTMATCH)) ||
+ (!rc && (p->flags & RULEFLAG_NOTMATCH)) ) ) {
+- return 0;
++ return RULE_RC_NOMATCH;
+ }
+
+ /* It matched, wow! Now it's time to prepare the context structure for
+@@ -4204,7 +4262,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+ }
+ }
+ else if (!rc) {
+- return 0;
++ return RULE_RC_NOMATCH;
+ }
+
+ /* If some HTTP header was involved in the condition, remember it
+@@ -4224,6 +4282,15 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+ newuri = do_expand(p->output, ctx, p);
+ rewritelog((r, 2, ctx->perdir, "rewrite '%s' -> '%s'", ctx->uri,
+ newuri));
++ if (!(p->flags & RULEFLAG_UNSAFE_ALLOW3F) &&
++ ap_strcasestr(r->unparsed_uri, "%3f") &&
++ ap_strchr_c(newuri, '?')) {
++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO()
++ "Unsafe URL with %%3f URL rewritten without "
++ "UnsafeAllow3F");
++ r->status = HTTP_FORBIDDEN;
++ return RULE_RC_STATUS_SET;
++ }
+ }
+
+ /* expand [E=var:val] and [CO=] */
+@@ -4241,7 +4308,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+ r->status = p->forced_responsecode;
+ }
+
+- return 2;
++ return RULE_RC_NOSUB;
+ }
+
+ /* Now adjust API's knowledge about r->filename and r->args */
+@@ -4293,7 +4360,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+ r->filename));
+
+ r->filename = apr_pstrcat(r->pool, "proxy:", r->filename, NULL);
+- return 1;
++ return RULE_RC_MATCH;
+ }
+
+ /* If this rule is explicitly forced for HTTP redirection
+@@ -4308,7 +4375,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+ r->filename));
+
+ r->status = p->forced_responsecode;
+- return 1;
++ return RULE_RC_MATCH;
+ }
+
+ /* Special Rewriting Feature: Self-Reduction
+@@ -4330,7 +4397,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+ "with %s", p->forced_responsecode, r->filename));
+
+ r->status = p->forced_responsecode;
+- return 1;
++ return RULE_RC_MATCH;
+ }
+
+ /* Finally remember the forced mime-type */
+@@ -4339,7 +4406,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+ /* Puuhhhhhhhh... WHAT COMPLICATED STUFF ;_)
+ * But now we're done for this particular rule.
+ */
+- return 1;
++ return RULE_RC_MATCH;
+ }
+
+ /*
+@@ -4347,13 +4414,13 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+ * i.e. a list of rewrite rules
+ */
+ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules,
+- char *perdir)
++ char *perdir, rewriterule_entry **lastsub)
+ {
+ rewriterule_entry *entries;
+ rewriterule_entry *p;
+ int i;
+ int changed;
+- int rc;
++ rule_return_type rc;
+ int s;
+ rewrite_ctx *ctx;
+ int round = 1;
+@@ -4361,6 +4428,7 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules,
+ ctx = apr_palloc(r->pool, sizeof(*ctx));
+ ctx->perdir = perdir;
+ ctx->r = r;
++ *lastsub = NULL;
+
+ /*
+ * Iterate over all existing rules
+@@ -4388,7 +4456,12 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules,
+ ctx->vary = NULL;
+ rc = apply_rewrite_rule(p, ctx);
+
+- if (rc) {
++ if (rc != RULE_RC_NOMATCH) {
++
++ if (!(p->flags & RULEFLAG_NOSUB)) {
++ rewritelog((r, 2, perdir, "setting lastsub to rule with output %s", p->output));
++ *lastsub = p;
++ }
+
+ /* Catch looping rules with pathinfo growing unbounded */
+ if ( strlen( r->filename ) > 2*r->server->limit_req_line ) {
+@@ -4408,6 +4481,12 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules,
+ apr_table_merge(r->headers_out, "Vary", ctx->vary);
+ }
+
++
++ /* Error while evaluating rule, r->status set */
++ if (RULE_RC_STATUS_SET == rc) {
++ return ACTION_STATUS_SET;
++ }
++
+ /*
+ * The rule sets the response code (implies match-only)
+ */
+@@ -4418,7 +4497,7 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules,
+ /*
+ * Indicate a change if this was not a match-only rule.
+ */
+- if (rc != 2) {
++ if (rc != RULE_RC_NOSUB) {
+ changed = ((p->flags & RULEFLAG_NOESCAPE)
+ ? ACTION_NOESCAPE : ACTION_NORMAL);
+ }
+@@ -4607,6 +4686,7 @@ static int hook_uri2file(request_rec *r)
+ int rulestatus;
+ void *skipdata;
+ const char *oargs;
++ rewriterule_entry *lastsub = NULL;
+
+ /*
+ * retrieve the config structures
+@@ -4718,7 +4798,7 @@ static int hook_uri2file(request_rec *r)
+ /*
+ * now apply the rules ...
+ */
+- rulestatus = apply_rewrite_list(r, conf->rewriterules, NULL);
++ rulestatus = apply_rewrite_list(r, conf->rewriterules, NULL, &lastsub);
+ apr_table_setn(r->notes, "mod_rewrite_rewritten",
+ apr_psprintf(r->pool,"%d",rulestatus));
+ }
+@@ -4756,6 +4836,9 @@ static int hook_uri2file(request_rec *r)
+ r->status = HTTP_OK;
+ return n;
+ }
++ else if (ACTION_STATUS_SET == rulestatus) {
++ return r->status;
++ }
+
+ if (to_proxyreq) {
+ /* it should be go on as an internal proxy request */
+@@ -4875,23 +4958,29 @@ static int hook_uri2file(request_rec *r)
+ return HTTP_BAD_REQUEST;
+ }
+
+- /* if there is no valid prefix, we call
+- * the translator from the core and
+- * prefix the filename with document_root
++ /* We have r->filename as a path in a server-context rewrite without
++ * the PT flag. The historical behavior is to treat it as a verbatim
++ * filesystem path iff the first component of the path exists and is
++ * readable by httpd. Otherwise, it is interpreted as DocumentRoot
++ * relative.
+ *
+ * NOTICE:
+ * We cannot leave out the prefix_stat because
+- * - when we always prefix with document_root
+- * then no absolute path can be created, e.g. via
+- * emulating a ScriptAlias directive, etc.
+- * - when we always NOT prefix with document_root
++ * - If we always prefix with document_root
++ * then no absolute path can could ever be used in
++ * a substitution. e.g. emulating an Alias.
++ * - If we never prefix with document_root
+ * then the files under document_root have to
+ * be references directly and document_root
+ * gets never used and will be a dummy parameter -
+- * this is also bad
++ * this is also bad.
++ * - Later addition: This part is questionable.
++ * If we had never prefixed, users would just
++ * need %{DOCUMENT_ROOT} in substitutions or the
++ * [PT] flag.
+ *
+ * BUT:
+- * Under real Unix systems this is no problem,
++ * Under real Unix systems this is no perf problem,
+ * because we only do stat() on the first directory
+ * and this gets cached by the kernel for along time!
+ */
+@@ -4900,7 +4989,9 @@ static int hook_uri2file(request_rec *r)
+ uri_reduced = apr_table_get(r->notes, "mod_rewrite_uri_reduced");
+ }
+
+- if (!prefix_stat(r->filename, r->pool) || uri_reduced != NULL) {
++ if (!prefix_stat(r, r->filename, r->pool,
++ conf->options & OPTION_UNSAFE_PREFIX_STAT ? NULL : lastsub)
++ || uri_reduced != NULL) {
+ int res;
+ char *tmp = r->uri;
+
+@@ -4945,6 +5036,7 @@ static int hook_fixup(request_rec *r)
+ char *ofilename, *oargs;
+ int is_proxyreq;
+ void *skipdata;
++ rewriterule_entry *lastsub;
+
+ dconf = (rewrite_perdir_conf *)ap_get_module_config(r->per_dir_config,
+ &rewrite_module);
+@@ -5029,7 +5121,7 @@ static int hook_fixup(request_rec *r)
+ /*
+ * now apply the rules ...
+ */
+- rulestatus = apply_rewrite_list(r, dconf->rewriterules, dconf->directory);
++ rulestatus = apply_rewrite_list(r, dconf->rewriterules, dconf->directory, &lastsub);
+ if (rulestatus) {
+ unsigned skip_absolute = is_absolute_uri(r->filename, NULL);
+ int to_proxyreq = 0;
+@@ -5058,6 +5150,9 @@ static int hook_fixup(request_rec *r)
+ r->status = HTTP_OK;
+ return n;
+ }
++ else if (ACTION_STATUS_SET == rulestatus) {
++ return r->status;
++ }
+
+ if (to_proxyreq) {
+ /* it should go on as an internal proxy request */
diff --git a/httpd-2.4.37-CVE-2024-38476.patch b/httpd-2.4.37-CVE-2024-38476.patch
new file mode 100644
index 0000000..0b35e4e
--- /dev/null
+++ b/httpd-2.4.37-CVE-2024-38476.patch
@@ -0,0 +1,545 @@
+diff --git a/include/http_protocol.h b/include/http_protocol.h
+index 8ed77ac..81949ca 100644
+--- a/include/http_protocol.h
++++ b/include/http_protocol.h
+@@ -402,6 +402,17 @@ AP_DECLARE(void) ap_clear_method_list(ap_method_list_t *l);
+ */
+ AP_DECLARE(void) ap_set_content_type(request_rec *r, const char *ct);
+
++/**
++ * Set the content type for this request (r->content_type).
++ * @param r The current request
++ * @param ct The new content type
++ * @param trusted If non-zero, The content-type should come from a
++ * trusted source such as server configuration rather
++ * than application output.
++ * for the AddOutputFilterByType directive to work correctly.
++ */
++AP_DECLARE(void) ap_set_content_type_ex(request_rec *r, const char *ct, int trusted);
++
+ /**
+ * Set the Accept-Ranges header for this response
+ * @param r The current request
+diff --git a/include/httpd.h b/include/httpd.h
+index 99f7f04..a8be236 100644
+--- a/include/httpd.h
++++ b/include/httpd.h
+@@ -685,6 +685,13 @@ struct ap_method_list_t {
+ /** Useful for common code with either platform charset. */
+ #define CRLF_ASCII "\015\012"
+
++/**
++ * These constants represent bitmasks for notes associated with this
++ * request. There are space for 64 bits in the apr_uint64_t.
++ *
++ */
++#define AP_REQUEST_TRUSTED_CT 1 << 1
++
+ /**
+ * @defgroup values_request_rec_body Possible values for request_rec.read_body
+ * @{
+@@ -715,6 +722,12 @@ struct ap_method_list_t {
+
+ /** @} // values_request_rec_used_path_info */
+
++/**
++ * Returns true if the content-type field is from a trusted source
++ */
++#define AP_REQUEST_IS_TRUSTED_CT(r) \
++ (!!AP_REQUEST_GET_BNOTE((r), AP_REQUEST_TRUSTED_CT))
++/** @} */
+
+ /*
+ * Things which may vary per file-lookup WITHIN a request ---
+diff --git a/modules/cluster/mod_heartmonitor.c b/modules/cluster/mod_heartmonitor.c
+index 965fef5..6df3bf4 100644
+--- a/modules/cluster/mod_heartmonitor.c
++++ b/modules/cluster/mod_heartmonitor.c
+@@ -782,7 +782,7 @@ static int hm_handler(request_rec *r)
+ hmserver.seen = apr_time_now();
+ hm_update_stat(ctx, &hmserver, r->pool);
+
+- ap_set_content_type(r, "text/plain");
++ ap_set_content_type_ex(r, "text/plain", 1);
+ ap_set_content_length(r, 2);
+ ap_rputs("OK", r);
+ ap_rflush(r);
+diff --git a/modules/dav/main/mod_dav.c b/modules/dav/main/mod_dav.c
+index 792b514..28479b9 100644
+--- a/modules/dav/main/mod_dav.c
++++ b/modules/dav/main/mod_dav.c
+@@ -323,7 +323,7 @@ static int dav_error_response(request_rec *r, int status, const char *body)
+ r->status = status;
+ r->status_line = ap_get_status_line(status);
+
+- ap_set_content_type(r, "text/html; charset=ISO-8859-1");
++ ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1);
+
+ /* begin the response now... */
+ ap_rvputs(r,
+@@ -354,7 +354,7 @@ static int dav_error_response_tag(request_rec *r,
+ {
+ r->status = err->status;
+
+- ap_set_content_type(r, DAV_XML_CONTENT_TYPE);
++ ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1);
+
+ ap_rputs(DAV_XML_HEADER DEBUG_CR
+ "status = status;
+- ap_set_content_type(r, DAV_XML_CONTENT_TYPE);
++ ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1);
+
+ /* Send the headers and actual multistatus response now... */
+ ap_fputs(r->output_filters, bb, DAV_XML_HEADER DEBUG_CR
+@@ -1923,7 +1923,7 @@ static int dav_method_options(request_rec *r)
+
+ /* send the options response */
+ r->status = HTTP_OK;
+- ap_set_content_type(r, DAV_XML_CONTENT_TYPE);
++ ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1);
+
+ /* send the headers and response body */
+ ap_rputs(DAV_XML_HEADER DEBUG_CR
+@@ -3191,7 +3191,7 @@ static int dav_method_lock(request_rec *r)
+ (*locks_hooks->close_lockdb)(lockdb);
+
+ r->status = HTTP_OK;
+- ap_set_content_type(r, DAV_XML_CONTENT_TYPE);
++ ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1);
+
+ ap_rputs(DAV_XML_HEADER DEBUG_CR "" DEBUG_CR, r);
+ if (lock == NULL)
+diff --git a/modules/examples/mod_example_hooks.c b/modules/examples/mod_example_hooks.c
+index d818dc1..4d79b86 100644
+--- a/modules/examples/mod_example_hooks.c
++++ b/modules/examples/mod_example_hooks.c
+@@ -993,7 +993,7 @@ static int x_handler(request_rec *r)
+ * Set the Content-type header. Note that we do not actually have to send
+ * the headers: this is done by the http core.
+ */
+- ap_set_content_type(r, "text/html");
++ ap_set_content_type_ex(r, "text/html", 1);
+ /*
+ * If we're only supposed to send header information (HEAD request), we're
+ * already there.
+diff --git a/modules/filters/mod_data.c b/modules/filters/mod_data.c
+index d083d32..489e76c 100644
+--- a/modules/filters/mod_data.c
++++ b/modules/filters/mod_data.c
+@@ -117,7 +117,7 @@ static apr_status_t data_out_filter(ap_filter_t *f, apr_bucket_brigade *bb)
+ }
+ }
+
+- ap_set_content_type(r, "text/plain");
++ ap_set_content_type_ex(r, "text/plain", 1);
+
+ }
+
+diff --git a/modules/filters/mod_include.c b/modules/filters/mod_include.c
+index a46a944..05f994c 100644
+--- a/modules/filters/mod_include.c
++++ b/modules/filters/mod_include.c
+@@ -3971,7 +3971,7 @@ static int include_fixup(request_rec *r)
+ if (r->handler && (strcmp(r->handler, "server-parsed") == 0))
+ {
+ if (!r->content_type || !*r->content_type) {
+- ap_set_content_type(r, "text/html");
++ ap_set_content_type_ex(r, "text/html", 1);
+ }
+ r->handler = "default-handler";
+ }
+diff --git a/modules/filters/mod_proxy_html.c b/modules/filters/mod_proxy_html.c
+index ea6bf03..8b619e8 100644
+--- a/modules/filters/mod_proxy_html.c
++++ b/modules/filters/mod_proxy_html.c
+@@ -933,7 +933,7 @@ static apr_status_t proxy_html_filter(ap_filter_t *f, apr_bucket_brigade *bb)
+ ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, f->r, APLOGNO(01422)
+ "No i18n support found. Install mod_xml2enc if required");
+ enc = XML_CHAR_ENCODING_NONE;
+- ap_set_content_type(f->r, "text/html;charset=utf-8");
++ ap_set_content_type_ex(f->r, "text/html;charset=utf-8", 1);
+ }
+ else {
+ /* if we wanted a non-default charset_out, insert the
+@@ -949,7 +949,7 @@ static apr_status_t proxy_html_filter(ap_filter_t *f, apr_bucket_brigade *bb)
+ cenc, NULL));
+ }
+ else /* Normal case, everything worked, utf-8 output */
+- ap_set_content_type(f->r, "text/html;charset=utf-8");
++ ap_set_content_type_ex(f->r, "text/html;charset=utf-8", 1);
+ }
+
+ ap_fputs(f->next, ctxt->bb, ctxt->cfg->doctype);
+diff --git a/modules/generators/mod_cgi.c b/modules/generators/mod_cgi.c
+index 66cd31c..4650d18 100644
+--- a/modules/generators/mod_cgi.c
++++ b/modules/generators/mod_cgi.c
+@@ -795,7 +795,7 @@ static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f,
+ /* Force sub_req to be treated as a CGI request, even if ordinary
+ * typing rules would have called it something else.
+ */
+- ap_set_content_type(rr, CGI_MAGIC_TYPE);
++ ap_set_content_type_ex(rr, CGI_MAGIC_TYPE, 1);
+
+ /* Run it. */
+ rr_status = ap_run_sub_req(rr);
+diff --git a/modules/generators/mod_cgid.c b/modules/generators/mod_cgid.c
+index 102d2b3..57e119f 100644
+--- a/modules/generators/mod_cgid.c
++++ b/modules/generators/mod_cgid.c
+@@ -1801,7 +1801,7 @@ static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f,
+ /* Force sub_req to be treated as a CGI request, even if ordinary
+ * typing rules would have called it something else.
+ */
+- ap_set_content_type(rr, CGI_MAGIC_TYPE);
++ ap_set_content_type_ex(rr, CGI_MAGIC_TYPE, 1);
+
+ /* Run it. */
+ rr_status = ap_run_sub_req(rr);
+diff --git a/modules/generators/mod_info.c b/modules/generators/mod_info.c
+index e5e63de..67df675 100644
+--- a/modules/generators/mod_info.c
++++ b/modules/generators/mod_info.c
+@@ -777,7 +777,7 @@ static int display_info(request_rec * r)
+ return DECLINED;
+ }
+
+- ap_set_content_type(r, "text/html; charset=ISO-8859-1");
++ ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1);
+
+ ap_rputs(DOCTYPE_XHTML_1_0T
+ "\n"
+diff --git a/modules/generators/mod_status.c b/modules/generators/mod_status.c
+index 5bada07..2cb38c7 100644
+--- a/modules/generators/mod_status.c
++++ b/modules/generators/mod_status.c
+@@ -273,7 +273,7 @@ static int status_handler(request_rec *r)
+ if (r->method_number != M_GET)
+ return DECLINED;
+
+- ap_set_content_type(r, "text/html; charset=ISO-8859-1");
++ ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1);
+
+ /*
+ * Simple table-driven form data set parser that lets you alter the header
+@@ -301,7 +301,7 @@ static int status_handler(request_rec *r)
+ no_table_report = 1;
+ break;
+ case STAT_OPT_AUTO:
+- ap_set_content_type(r, "text/plain; charset=ISO-8859-1");
++ ap_set_content_type_ex(r, "text/plain; charset=ISO-8859-1", 1);
+ short_report = 1;
+ break;
+ }
+diff --git a/modules/http/http_filters.c b/modules/http/http_filters.c
+index 16cb23c..27c44b2 100644
+--- a/modules/http/http_filters.c
++++ b/modules/http/http_filters.c
+@@ -1245,7 +1245,7 @@ AP_DECLARE_NONSTD(int) ap_send_http_trace(request_rec *r)
+ }
+ }
+
+- ap_set_content_type(r, "message/http");
++ ap_set_content_type_ex(r, "message/http", 1);
+
+ /* Now we recreate the request, and echo it back */
+
+diff --git a/modules/http/http_protocol.c b/modules/http/http_protocol.c
+index dcafa9c..d003aea 100644
+--- a/modules/http/http_protocol.c
++++ b/modules/http/http_protocol.c
+@@ -1077,8 +1077,14 @@ AP_DECLARE(void) ap_set_content_type(request_rec *r, const char *ct)
+ }
+ else if (!r->content_type || strcmp(r->content_type, ct)) {
+ r->content_type = ct;
++ AP_REQUEST_SET_BNOTE(r, AP_REQUEST_TRUSTED_CT, 0);
+ }
+ }
++AP_DECLARE(void) ap_set_content_type_ex(request_rec *r, const char *ct, int trusted)
++{
++ ap_set_content_type(r, ct);
++ AP_REQUEST_SET_BNOTE(r, AP_REQUEST_TRUSTED_CT, trusted ? AP_REQUEST_TRUSTED_CT : 0);
++}
+
+ AP_DECLARE(void) ap_set_accept_ranges(request_rec *r)
+ {
+@@ -1417,10 +1423,10 @@ AP_DECLARE(void) ap_send_error_response(request_rec *r, int recursive_error)
+ request_conf->suppress_charset = 1; /* avoid adding default
+ * charset later
+ */
+- ap_set_content_type(r, "text/html");
++ ap_set_content_type_ex(r, "text/html", 1);
+ }
+ else {
+- ap_set_content_type(r, "text/html; charset=iso-8859-1");
++ ap_set_content_type_ex(r, "text/html; charset=iso-8859-1", 1);
+ }
+
+ if ((status == HTTP_METHOD_NOT_ALLOWED)
+diff --git a/modules/http/http_request.c b/modules/http/http_request.c
+index e873aab..f5193db 100644
+--- a/modules/http/http_request.c
++++ b/modules/http/http_request.c
+@@ -709,7 +709,7 @@ AP_DECLARE(void) ap_internal_fast_redirect(request_rec *rr, request_rec *r)
+ r->args = rr->args;
+ r->finfo = rr->finfo;
+ r->handler = rr->handler;
+- ap_set_content_type(r, rr->content_type);
++ ap_set_content_type_ex(r, rr->content_type, AP_REQUEST_IS_TRUSTED_CT(r));
+ r->content_encoding = rr->content_encoding;
+ r->content_languages = rr->content_languages;
+ r->per_dir_config = rr->per_dir_config;
+diff --git a/modules/http/mod_mime.c b/modules/http/mod_mime.c
+index 28c53be..4cd1c48 100644
+--- a/modules/http/mod_mime.c
++++ b/modules/http/mod_mime.c
+@@ -759,7 +759,7 @@ static int find_ct(request_rec *r)
+ int found_metadata = 0;
+
+ if (r->finfo.filetype == APR_DIR) {
+- ap_set_content_type(r, DIR_MAGIC_TYPE);
++ ap_set_content_type_ex(r, DIR_MAGIC_TYPE, 1);
+ return OK;
+ }
+
+@@ -837,7 +837,7 @@ static int find_ct(request_rec *r)
+ if (exinfo == NULL || !exinfo->forced_type) {
+ if ((type = apr_hash_get(mime_type_extensions, ext,
+ APR_HASH_KEY_STRING)) != NULL) {
+- ap_set_content_type(r, (char*) type);
++ ap_set_content_type_ex(r, (char*) type, 1);
+ found = 1;
+ }
+ }
+@@ -846,7 +846,7 @@ static int find_ct(request_rec *r)
+
+ /* empty string is treated as special case for RemoveType */
+ if (exinfo->forced_type && *exinfo->forced_type) {
+- ap_set_content_type(r, exinfo->forced_type);
++ ap_set_content_type_ex(r, exinfo->forced_type, 1);
+ found = 1;
+ }
+
+@@ -951,33 +951,33 @@ static int find_ct(request_rec *r)
+ memcpy(tmp, ctp->subtype, ctp->subtype_len);
+ tmp += ctp->subtype_len;
+ *tmp = 0;
+- ap_set_content_type(r, base_content_type);
++ ap_set_content_type_ex(r, base_content_type, AP_REQUEST_IS_TRUSTED_CT(r));
+ while (pp != NULL) {
+ if (charset && !strcmp(pp->attr, "charset")) {
+ if (!override) {
+- ap_set_content_type(r,
++ ap_set_content_type_ex(r,
+ apr_pstrcat(r->pool,
+ r->content_type,
+ "; charset=",
+ charset,
+- NULL));
++ NULL), AP_REQUEST_IS_TRUSTED_CT(r));
+ override = 1;
+ }
+ }
+ else {
+- ap_set_content_type(r,
++ ap_set_content_type_ex(r,
+ apr_pstrcat(r->pool,
+ r->content_type,
+ "; ", pp->attr,
+ "=", pp->val,
+- NULL));
++ NULL), AP_REQUEST_IS_TRUSTED_CT(r));
+ }
+ pp = pp->next;
+ }
+ if (charset && !override) {
+- ap_set_content_type(r, apr_pstrcat(r->pool, r->content_type,
++ ap_set_content_type_ex(r, apr_pstrcat(r->pool, r->content_type,
+ "; charset=", charset,
+- NULL));
++ NULL), AP_REQUEST_IS_TRUSTED_CT(r));
+ }
+ }
+ }
+diff --git a/modules/ldap/util_ldap.c b/modules/ldap/util_ldap.c
+index eecb3f7..b71dc98 100644
+--- a/modules/ldap/util_ldap.c
++++ b/modules/ldap/util_ldap.c
+@@ -125,7 +125,7 @@ static int util_ldap_handler(request_rec *r)
+ st = (util_ldap_state_t *) ap_get_module_config(r->server->module_config,
+ &ldap_module);
+
+- ap_set_content_type(r, "text/html; charset=ISO-8859-1");
++ ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1);
+
+ if (r->header_only)
+ return OK;
+diff --git a/modules/mappers/mod_actions.c b/modules/mappers/mod_actions.c
+index ac9c3b7..5e398b5 100644
+--- a/modules/mappers/mod_actions.c
++++ b/modules/mappers/mod_actions.c
+@@ -182,8 +182,10 @@ static int action_handler(request_rec *r)
+ return DECLINED;
+
+ /* Second, check for actions (which override the method scripts) */
+- action = r->handler ? r->handler :
+- ap_field_noparam(r->pool, r->content_type);
++ action = r->handler;
++ if (!action && AP_REQUEST_IS_TRUSTED_CT(r)) {
++ action = ap_field_noparam(r->pool, r->content_type);
++ }
+
+ if (action && (t = apr_table_get(conf->action_types, action))) {
+ int virtual = (*t++ == '0' ? 0 : 1);
+diff --git a/modules/mappers/mod_imagemap.c b/modules/mappers/mod_imagemap.c
+index 187a500..3e14933 100644
+--- a/modules/mappers/mod_imagemap.c
++++ b/modules/mappers/mod_imagemap.c
+@@ -475,7 +475,7 @@ static int imap_reply(request_rec *r, const char *redirect)
+
+ static void menu_header(request_rec *r, char *menu)
+ {
+- ap_set_content_type(r, "text/html; charset=ISO-8859-1");
++ ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1);
+
+ ap_rvputs(r, DOCTYPE_HTML_3_2, "\nMenu for ",
+ ap_escape_html(r->pool, r->uri),
+diff --git a/modules/mappers/mod_negotiation.c b/modules/mappers/mod_negotiation.c
+index da68353..e91ba5f 100644
+--- a/modules/mappers/mod_negotiation.c
++++ b/modules/mappers/mod_negotiation.c
+@@ -1169,7 +1169,7 @@ static int read_types_multi(negotiation_state *neg)
+ * might be doing.
+ */
+ if (sub_req->handler && !sub_req->content_type) {
+- ap_set_content_type(sub_req, CGI_MAGIC_TYPE);
++ ap_set_content_type_ex(sub_req, CGI_MAGIC_TYPE, 1);
+ }
+
+ /*
+@@ -3008,14 +3008,14 @@ static int handle_map_file(request_rec *r)
+ /* set MIME type and charset as negotiated */
+ if (best->mime_type && *best->mime_type) {
+ if (best->content_charset && *best->content_charset) {
+- ap_set_content_type(r, apr_pstrcat(r->pool,
++ ap_set_content_type_ex(r, apr_pstrcat(r->pool,
+ best->mime_type,
+ "; charset=",
+ best->content_charset,
+- NULL));
++ NULL), 1);
+ }
+ else {
+- ap_set_content_type(r, apr_pstrdup(r->pool, best->mime_type));
++ ap_set_content_type_ex(r, apr_pstrdup(r->pool, best->mime_type), 1);
+ }
+ }
+
+diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
+index b71c67c..1735f6d 100644
+--- a/modules/mappers/mod_rewrite.c
++++ b/modules/mappers/mod_rewrite.c
+@@ -5297,7 +5297,7 @@ static int hook_mimetype(request_rec *r)
+ rewritelog((r, 1, NULL, "force filename %s to have MIME-type '%s'",
+ r->filename, t));
+
+- ap_set_content_type(r, t);
++ ap_set_content_type_ex(r, t, 1);
+ }
+
+ /* handler */
+diff --git a/modules/metadata/mod_headers.c b/modules/metadata/mod_headers.c
+index 1ea970d..55ab281 100644
+--- a/modules/metadata/mod_headers.c
++++ b/modules/metadata/mod_headers.c
+@@ -792,14 +792,14 @@ static int do_headers_fixup(request_rec *r, apr_table_t *headers,
+ break;
+ case hdr_set:
+ if (!strcasecmp(hdr->header, "Content-Type")) {
+- ap_set_content_type(r, process_tags(hdr, r));
++ ap_set_content_type_ex(r, process_tags(hdr, r), 1);
+ }
+ apr_table_setn(headers, hdr->header, process_tags(hdr, r));
+ break;
+ case hdr_setifempty:
+ if (NULL == apr_table_get(headers, hdr->header)) {
+ if (!strcasecmp(hdr->header, "Content-Type")) {
+- ap_set_content_type(r, process_tags(hdr, r));
++ ap_set_content_type_ex(r, process_tags(hdr, r), 1);
+ }
+ apr_table_setn(headers, hdr->header, process_tags(hdr, r));
+ }
+@@ -818,7 +818,7 @@ static int do_headers_fixup(request_rec *r, apr_table_t *headers,
+ const char *repl = process_regexp(hdr, r->content_type, r);
+ if (repl == NULL)
+ return 0;
+- ap_set_content_type(r, repl);
++ ap_set_content_type_ex(r, repl, 1);
+ }
+ if (apr_table_get(headers, hdr->header)) {
+ edit_do ed;
+diff --git a/modules/metadata/mod_mime_magic.c b/modules/metadata/mod_mime_magic.c
+index c12529a..fe30f27 100644
+--- a/modules/metadata/mod_mime_magic.c
++++ b/modules/metadata/mod_mime_magic.c
+@@ -789,7 +789,7 @@ static int magic_rsl_to_request(request_rec *r)
+ /* XXX: this could be done at config time I'm sure... but I'm
+ * confused by all this magic_rsl stuff. -djg */
+ ap_content_type_tolower(tmp);
+- ap_set_content_type(r, tmp);
++ ap_set_content_type_ex(r, tmp, 1);
+
+ if (state == rsl_encoding) {
+ tmp = rsl_strdup(r, encoding_frag,
+@@ -2326,7 +2326,7 @@ static int revision_suffix(request_rec *r)
+
+ /* extract content type/encoding/language from sub-request */
+ if (sub->content_type) {
+- ap_set_content_type(r, apr_pstrdup(r->pool, sub->content_type));
++ ap_set_content_type_ex(r, apr_pstrdup(r->pool, sub->content_type), 1);
+ #if MIME_MAGIC_DEBUG
+ ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(01557)
+ MODNAME ": subrequest %s got %s",
+diff --git a/modules/proxy/mod_proxy_balancer.c b/modules/proxy/mod_proxy_balancer.c
+index c599e1a..d5c20af 100644
+--- a/modules/proxy/mod_proxy_balancer.c
++++ b/modules/proxy/mod_proxy_balancer.c
+@@ -1480,7 +1480,7 @@ static int balancer_handler(request_rec *r)
+
+ if (apr_table_get(params, "xml")) {
+ char date[APR_RFC822_DATE_LEN];
+- ap_set_content_type(r, "text/xml");
++ ap_set_content_type_ex(r, "text/xml", 1);
+ ap_rputs("<?xml version='1.0' encoding='UTF-8' ?>\n", r);
+ ap_rputs("<httpd:manager xmlns:httpd='http://httpd.apache.org'>\n", r);
+ ap_rputs(" <httpd:balancers>\n", r);
+diff --git a/server/config.c b/server/config.c
+index f815b22..fc4d76b 100644
+--- a/server/config.c
++++ b/server/config.c
+@@ -419,7 +419,7 @@ AP_CORE_DECLARE(int) ap_invoke_handler(request_rec *r)
+ }
+
+ if (!r->handler) {
+- if (r->content_type) {
++ if (r->content_type && AP_REQUEST_IS_TRUSTED_CT(r)) {
+ handler = r->content_type;
+ if ((p=ap_strchr_c(handler, ';')) != NULL) {
+ char *new_handler = (char *)apr_pmemdup(r->pool, handler,
+diff --git a/server/core.c b/server/core.c
+index ba3b87f..a9e0e4a 100644
+--- a/server/core.c
++++ b/server/core.c
+@@ -4722,7 +4722,7 @@ static int core_override_type(request_rec *r)
+ /* Check for overrides with ForceType / SetHandler
+ */
+ if (conf->mime_type && strcmp(conf->mime_type, "none"))
+- ap_set_content_type(r, (char*) conf->mime_type);
++ ap_set_content_type_ex(r, (char*) conf->mime_type, 1);
+
+ if (conf->expr_handler) {
+ const char *err;
diff --git a/httpd-2.4.37-CVE-2024-38477.patch b/httpd-2.4.37-CVE-2024-38477.patch
new file mode 100644
index 0000000..38dc2db
--- /dev/null
+++ b/httpd-2.4.37-CVE-2024-38477.patch
@@ -0,0 +1,29 @@
+diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c
+index 6244e74..f5c3283 100644
+--- a/modules/proxy/proxy_util.c
++++ b/modules/proxy/proxy_util.c
+@@ -2406,6 +2406,13 @@ ap_proxy_determine_connection(apr_pool_t *p, request_rec *r,
+ apr_pstrcat(p,"URI cannot be parsed: ", *url,
+ NULL));
+ }
++
++ if (!uri->hostname) {
++ return ap_proxyerror(r, HTTP_BAD_REQUEST,
++ apr_pstrcat(p,"URI has no hostname: ", *url,
++ NULL));
++ }
++
+ if (!uri->port) {
+ uri->port = ap_proxy_port_of_scheme(uri->scheme);
+ }
+@@ -3727,6 +3734,10 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p,
+ * way. No telling which legacy backend is relying no this.
+ */
+ if (dconf->preserve_host == 0) {
++ if (!uri->hostname) {
++ rc = HTTP_BAD_REQUEST;
++ goto cleanup;
++ }
+ if (ap_strchr_c(uri->hostname, ':')) { /* if literal IPv6 address */
+ if (uri->port_str && uri->port != DEFAULT_HTTP_PORT) {
+ buf = apr_pstrcat(p, "Host: [", uri->hostname, "]:",
diff --git a/httpd-2.4.37-CVE-2024-39573.patch b/httpd-2.4.37-CVE-2024-39573.patch
new file mode 100644
index 0000000..e472b5e
--- /dev/null
+++ b/httpd-2.4.37-CVE-2024-39573.patch
@@ -0,0 +1,56 @@
+diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
+index 797f093..114b126 100644
+--- a/modules/mappers/mod_rewrite.c
++++ b/modules/mappers/mod_rewrite.c
+@@ -4311,6 +4311,32 @@ static rule_return_type apply_rewrite_rule(rewriterule_entry *p,
+ return RULE_RC_NOSUB;
+ }
+
++ /* Add the previously stripped per-directory location prefix, unless
++ * (1) it's an absolute URL path and
++ * (2) it's a full qualified URL
++ */
++ if (!is_proxyreq && *newuri != '/' && !is_absolute_uri(newuri, NULL)) {
++ if (ctx->perdir) {
++ rewritelog((r, 3, ctx->perdir, "add per-dir prefix: %s -> %s%s",
++ newuri, ctx->perdir, newuri));
++
++ newuri = apr_pstrcat(r->pool, ctx->perdir, newuri, NULL);
++ }
++ else if (!(p->flags & (RULEFLAG_PROXY | RULEFLAG_FORCEREDIRECT))) {
++ /* Not an absolute URI-path and the scheme (if any) is unknown,
++ * and it won't be passed to fully_qualify_uri() below either,
++ * so add an implicit '/' prefix. This avoids potentially a common
++ * rule like "RewriteRule ^/some/path(.*) $1" that is given a path
++ * like "/some/pathscheme:..." to produce the fully qualified URL
++ * "scheme:..." which could be misinterpreted later.
++ */
++ rewritelog((r, 3, ctx->perdir, "add root prefix: %s -> /%s",
++ newuri, newuri));
++
++ newuri = apr_pstrcat(r->pool, "/", newuri, NULL);
++ }
++ }
++
+ /* Now adjust API's knowledge about r->filename and r->args */
+ r->filename = newuri;
+
+@@ -4320,18 +4346,6 @@ static rule_return_type apply_rewrite_rule(rewriterule_entry *p,
+
+ splitout_queryargs(r, p->flags);
+
+- /* Add the previously stripped per-directory location prefix, unless
+- * (1) it's an absolute URL path and
+- * (2) it's a full qualified URL
+- */
+- if ( ctx->perdir && !is_proxyreq && *r->filename != '/'
+- && !is_absolute_uri(r->filename, NULL)) {
+- rewritelog((r, 3, ctx->perdir, "add per-dir prefix: %s -> %s%s",
+- r->filename, ctx->perdir, r->filename));
+-
+- r->filename = apr_pstrcat(r->pool, ctx->perdir, r->filename, NULL);
+- }
+-
+ /* If this rule is forced for proxy throughput
+ * (`RewriteRule ... ... [P]') then emulate mod_proxy's
+ * URL-to-filename handler to be sure mod_proxy is triggered
diff --git a/httpd.spec b/httpd.spec
index 2b2e7a0..6c15e25 100644
--- a/httpd.spec
+++ b/httpd.spec
@@ -13,7 +13,7 @@
Summary: Apache HTTP Server
Name: httpd
Version: 2.4.37
-Release: 65%{?dist}
+Release: 65%{?dist}.1
URL: https://httpd.apache.org/
Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
Source2: httpd.logrotate
@@ -260,6 +260,16 @@ Patch239: httpd-2.4.37-CVE-2023-27522.patch
Patch240: httpd-2.4.37-CVE-2023-31122.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=2273491
Patch241: httpd-2.4.37-CVE-2023-38709.patch
+# CVE-2024-38474 and CVE-2024-38475 fixed in one patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2295013
+# https://bugzilla.redhat.com/show_bug.cgi?id=2295014
+Patch242: httpd-2.4.37-CVE-2024-38474+.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2295012
+Patch243: httpd-2.4.37-CVE-2024-38473.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2295016
+Patch244: httpd-2.4.37-CVE-2024-38477.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2295022
+Patch245: httpd-2.4.37-CVE-2024-39573.patch
License: ASL 2.0
Group: System Environment/Daemons
@@ -487,6 +497,10 @@ interface for storing and accessing per-user session data.
%patch239 -p1 -b .CVE-2023-27522
%patch240 -p1 -b .CVE-2023-31122
%patch241 -p1 -b .CVE-2023-38709
+%patch242 -p1 -b .CVE-2024-38474+
+%patch243 -p1 -b .CVE-2024-38473
+%patch244 -p1 -b .CVE-2024-38477
+%patch245 -p1 -b .CVE-2024-39573
# Patch in the vendor string
sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -992,6 +1006,18 @@ rm -rf $RPM_BUILD_ROOT
%{_rpmconfigdir}/macros.d/macros.httpd
%changelog
+* Thu Jul 11 2024 Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-65.1
+- Resolves: RHEL-45812 - httpd:2.4/httpd: Substitution encoding issue
+ in mod_rewrite (CVE-2024-38474)
+- Resolves: RHEL-45785 - httpd:2.4/httpd: Encoding problem in
+ mod_proxy (CVE-2024-38473)
+- Resolves: RHEL-45777 - httpd:2.4/httpd: Improper escaping of output
+ in mod_rewrite (CVE-2024-38475)
+- Resolves: RHEL-45758 - httpd:2.4/httpd: null pointer dereference
+ in mod_proxy (CVE-2024-38477)
+- Resolves: RHEL-45743 - httpd:2.4/httpd: Potential SSRF
+ in mod_rewrite (CVE-2024-39573)
+
* Wed Jun 12 2024 Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-65
- Resolves: RHEL-31857 - httpd:2.4/httpd: HTTP response
splitting (CVE-2023-38709)