From 5be0469cd1688bb6f8dca3e18bcfa0fcd6a47fe9 Mon Sep 17 00:00:00 2001 From: eabdullin Date: Tue, 23 Jul 2024 12:24:43 +0000 Subject: [PATCH] import UBI httpd-2.4.37-65.module+el8.10.0+22069+b47f5c72.1 --- SOURCES/httpd-2.4.37-CVE-2024-38473.patch | 172 ++++++++ SOURCES/httpd-2.4.37-CVE-2024-38474+.patch | 439 +++++++++++++++++++++ SOURCES/httpd-2.4.37-CVE-2024-38477.patch | 29 ++ SOURCES/httpd-2.4.37-CVE-2024-39573.patch | 56 +++ SPECS/httpd.spec | 28 +- 5 files changed, 723 insertions(+), 1 deletion(-) create mode 100644 SOURCES/httpd-2.4.37-CVE-2024-38473.patch create mode 100644 SOURCES/httpd-2.4.37-CVE-2024-38474+.patch create mode 100644 SOURCES/httpd-2.4.37-CVE-2024-38477.patch create mode 100644 SOURCES/httpd-2.4.37-CVE-2024-39573.patch diff --git a/SOURCES/httpd-2.4.37-CVE-2024-38473.patch b/SOURCES/httpd-2.4.37-CVE-2024-38473.patch new file mode 100644 index 0000000..7c26944 --- /dev/null +++ b/SOURCES/httpd-2.4.37-CVE-2024-38473.patch @@ -0,0 +1,172 @@ +diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c +index a6df1b8..94ec87e 100644 +--- a/modules/proxy/mod_proxy.c ++++ b/modules/proxy/mod_proxy.c +@@ -968,6 +968,7 @@ static int proxy_fixup(request_rec *r) + + return OK; /* otherwise; we've done the best we can */ + } ++ + /* Send a redirection if the request contains a hostname which is not */ + /* fully qualified, i.e. doesn't have a domain name appended. Some proxy */ + /* servers like Netscape's allow this and access hosts from the local */ +@@ -1021,7 +1022,7 @@ static int proxy_handler(request_rec *r) + ap_get_module_config(sconf, &proxy_module); + apr_array_header_t *proxies = conf->proxies; + struct proxy_remote *ents = (struct proxy_remote *) proxies->elts; +- int i, rc, access_status; ++ int rc = DECLINED, access_status, i; + int direct_connect = 0; + const char *str; + apr_int64_t maxfwd; +@@ -1036,19 +1037,28 @@ static int proxy_handler(request_rec *r) + return DECLINED; + } + +- if (!r->proxyreq) { +- /* We may have forced the proxy handler via config or .htaccess */ +- if (r->handler && +- strncmp(r->handler, "proxy:", 6) == 0 && +- strncmp(r->filename, "proxy:", 6) != 0) { +- r->proxyreq = PROXYREQ_REVERSE; +- r->filename = apr_pstrcat(r->pool, r->handler, r->filename, NULL); ++ /* We may have forced the proxy handler via config or .htaccess */ ++ if (!r->proxyreq && r->handler && strncmp(r->handler, "proxy:", 6) == 0) { ++ char *old_filename = r->filename; ++ ++ r->proxyreq = PROXYREQ_REVERSE; ++ r->filename = apr_pstrcat(r->pool, r->handler, r->filename, NULL); ++ ++ /* Still need to fixup/canonicalize r->filename */ ++ rc = ap_proxy_fixup_uds_filename(r); ++ if (rc <= OK) { ++ rc = proxy_fixup(r); + } +- else { +- return DECLINED; ++ if (rc != OK) { ++ r->filename = old_filename; ++ r->proxyreq = 0; + } +- } else if (strncmp(r->filename, "proxy:", 6) != 0) { +- return DECLINED; ++ } ++ else if (r->proxyreq && strncmp(r->filename, "proxy:", 6) == 0) { ++ rc = OK; ++ } ++ if (rc != OK) { ++ return rc; + } + + /* handle max-forwards / OPTIONS / TRACE */ +diff --git a/modules/proxy/mod_proxy.h b/modules/proxy/mod_proxy.h +index e5c0a26..354f395 100644 +--- a/modules/proxy/mod_proxy.h ++++ b/modules/proxy/mod_proxy.h +@@ -921,6 +921,14 @@ PROXY_DECLARE(proxy_balancer_shared *) ap_proxy_find_balancershm(ap_slotmem_prov + proxy_balancer *balancer, + unsigned int *index); + ++/* ++ * Strip the UDS part of r->filename if any, and put the UDS path in ++ * r->notes ("uds_path") ++ * @param r current request ++ * @return OK if fixed up, DECLINED if not UDS, or an HTTP_XXX error ++ */ ++PROXY_DECLARE(int) ap_proxy_fixup_uds_filename(request_rec *r); ++ + /** + * Get the most suitable worker and/or balancer for the request + * @param worker worker used for processing request +diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c +index 6626ea0..6244e74 100644 +--- a/modules/proxy/proxy_util.c ++++ b/modules/proxy/proxy_util.c +@@ -2098,7 +2098,7 @@ static int ap_proxy_retry_worker(const char *proxy_function, proxy_worker *worke + * were passed a UDS url (eg: from mod_proxy) and adjust uds_path + * as required. + */ +-static int fix_uds_filename(request_rec *r, char **url) ++PROXY_DECLARE(int) ap_proxy_fixup_uds_filename(request_rec *r) + { + char *uds_url = r->filename + 6, *origin_url; + +@@ -2106,7 +2106,6 @@ static int fix_uds_filename(request_rec *r, char **url) + !ap_cstr_casecmpn(uds_url, "unix:", 5) && + (origin_url = ap_strchr(uds_url + 5, '|'))) { + char *uds_path = NULL; +- apr_size_t url_len; + apr_uri_t urisock; + apr_status_t rv; + +@@ -2122,21 +2121,20 @@ static int fix_uds_filename(request_rec *r, char **url) + if (!uds_path) { + ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10292) + "Invalid proxy UDS filename (%s)", r->filename); +- return 0; ++ return HTTP_BAD_REQUEST; + } + apr_table_setn(r->notes, "uds_path", uds_path); + +- /* Remove the UDS path from *url and r->filename */ +- url_len = strlen(origin_url); +- *url = apr_pstrmemdup(r->pool, origin_url, url_len); +- memcpy(uds_url, *url, url_len + 1); +- + ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r, +- "*: rewrite of url due to UDS(%s): %s (%s)", +- uds_path, *url, r->filename); ++ "*: fixup UDS from %s: %s (%s)", ++ r->filename, origin_url, uds_path); ++ ++ /* Overwrite the UDS part in place */ ++ memmove(uds_url, origin_url, strlen(origin_url) + 1); ++ return OK; + } + +- return 1; ++ return DECLINED; + } + + PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker, +@@ -2155,9 +2153,6 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker, + ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r, + "%s: found worker %s for %s", + (*worker)->s->scheme, (*worker)->s->name, *url); +- if (!forward && !fix_uds_filename(r, url)) { +- return HTTP_INTERNAL_SERVER_ERROR; +- } + access_status = OK; + } + else if (forward) { +@@ -2187,9 +2182,6 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker, + * regarding the Connection header in the request. + */ + apr_table_setn(r->subprocess_env, "proxy-nokeepalive", "1"); +- if (!fix_uds_filename(r, url)) { +- return HTTP_INTERNAL_SERVER_ERROR; +- } + } + } + } +@@ -2199,6 +2191,20 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker, + "all workers are busy. Unable to serve %s", *url); + access_status = HTTP_SERVICE_UNAVAILABLE; + } ++ ++ if (access_status == OK && r->proxyreq == PROXYREQ_REVERSE) { ++ int rc = ap_proxy_fixup_uds_filename(r); ++ if (ap_is_HTTP_ERROR(rc)) { ++ return rc; ++ } ++ /* If the URL has changed in r->filename, take everything after ++ * the "proxy:" prefix. ++ */ ++ if (rc == OK) { ++ *url = apr_pstrdup(r->pool, r->filename + 6); ++ } ++ } ++ + return access_status; + } + diff --git a/SOURCES/httpd-2.4.37-CVE-2024-38474+.patch b/SOURCES/httpd-2.4.37-CVE-2024-38474+.patch new file mode 100644 index 0000000..2228924 --- /dev/null +++ b/SOURCES/httpd-2.4.37-CVE-2024-38474+.patch @@ -0,0 +1,439 @@ +diff --git a/docs/manual/mod/mod_rewrite.html.en b/docs/manual/mod/mod_rewrite.html.en +index 2b8ed35..b7f1c31 100644 +--- a/docs/manual/mod/mod_rewrite.html.en ++++ b/docs/manual/mod/mod_rewrite.html.en +@@ -1403,6 +1403,16 @@ cannot use $N in the substitution string! + Force the MIME-type of the target file + to be the specified type. details ... + ++ ++ UnsafeAllow3F ++ Allows substitutions from URL's that may be unsafe. ++ details ... ++ ++ ++ UnsafePrefixStat ++ Allows potentially unsafe substitutions from a leading variable or backreference to a filesystem path. ++ details ... ++ + + +

Home directory expansion

+diff --git a/docs/manual/rewrite/flags.html.en b/docs/manual/rewrite/flags.html.en +index 734809a..30d549d 100644 +--- a/docs/manual/rewrite/flags.html.en ++++ b/docs/manual/rewrite/flags.html.en +@@ -768,6 +768,30 @@ re-processing (including subsequent rounds of mod_rewrite processing). + The L flag can be useful in this context to end the + current round of mod_rewrite processing.

+ ++
++ ++
++

UnsafeAllow3F

++ ++

++Setting this flag is required to allow a rewrite to continue If the ++HTTP request being written has an encoded question mark, '%3f', and the ++rewritten result has a '?' in the substiution. This protects from a malicious ++URL taking advantage of a capture and re-substitution of the encoded ++question mark.

++ ++
++
++

UnsafePrefixStat

++ ++

++Setting this flag is required in server-scoped substitutions ++start with a variable or backreference and resolve to a filesystem path. ++These substitutions are not prefixed with the document root. ++This protects from a malicious URL causing the expanded substitution to ++map to an unexpected filesystem location. ++

++ +
+
+

Available Languages:  en  | +diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c +index b71c67c..797f093 100644 +--- a/modules/mappers/mod_rewrite.c ++++ b/modules/mappers/mod_rewrite.c +@@ -172,6 +172,8 @@ static const char* really_last_key = "rewrite_really_last"; + #define RULEFLAG_QSLAST (1<<19) + #define RULEFLAG_QSNONE (1<<20) /* programattic only */ + #define RULEFLAG_ESCAPECTLS (1<<21) ++#define RULEFLAG_UNSAFE_PREFIX_STAT (1<<22) ++#define RULEFLAG_UNSAFE_ALLOW3F (1<<23) + + /* return code of the rewrite rule + * the result may be escaped - or not +@@ -179,7 +181,7 @@ static const char* really_last_key = "rewrite_really_last"; + #define ACTION_NORMAL (1<<0) + #define ACTION_NOESCAPE (1<<1) + #define ACTION_STATUS (1<<2) +- ++#define ACTION_STATUS_SET (1<<3) + + #define MAPTYPE_TXT (1<<0) + #define MAPTYPE_DBM (1<<1) +@@ -203,6 +205,7 @@ static const char* really_last_key = "rewrite_really_last"; + #define OPTION_IGNORE_INHERIT (1<<8) + #define OPTION_IGNORE_CONTEXT_INFO (1<<9) + #define OPTION_LEGACY_PREFIX_DOCROOT (1<<10) ++#define OPTION_UNSAFE_PREFIX_STAT (1<<12) + + #ifndef RAND_MAX + #define RAND_MAX 32767 +@@ -296,6 +299,14 @@ typedef enum { + CONDPAT_AP_EXPR + } pattern_type; + ++typedef enum { ++ RULE_RC_NOMATCH = 0, /* the rule didn't match */ ++ RULE_RC_MATCH = 1, /* a matching rule w/ substitution */ ++ RULE_RC_NOSUB = 2, /* a matching rule w/ no substitution */ ++ RULE_RC_STATUS_SET = 3 /* a matching rule that has set an HTTP error ++ to be returned in r->status */ ++} rule_return_type; ++ + typedef struct { + char *input; /* Input string of RewriteCond */ + char *pattern; /* the RegExp pattern string */ +@@ -927,10 +938,15 @@ static void fully_qualify_uri(request_rec *r) + return; + } + ++static int startsWith(request_rec *r, const char *haystack, const char *needle) { ++ int rc = (ap_strstr_c(haystack, needle) == haystack); ++ rewritelog((r, 5, NULL, "prefix_stat startsWith(%s, %s) %d", haystack, needle, rc)); ++ return rc; ++} + /* +- * stat() only the first segment of a path ++ * stat() only the first segment of a path, and only if it matches the output of the last matching rule + */ +-static int prefix_stat(const char *path, apr_pool_t *pool) ++static int prefix_stat(request_rec *r, const char *path, apr_pool_t *pool, rewriterule_entry *lastsub) + { + const char *curpath = path; + const char *root; +@@ -964,10 +980,36 @@ static int prefix_stat(const char *path, apr_pool_t *pool) + apr_finfo_t sb; + + if (apr_stat(&sb, statpath, APR_FINFO_MIN, pool) == APR_SUCCESS) { +- return 1; ++ if (!lastsub) { ++ rewritelog((r, 3, NULL, "prefix_stat no lastsub subst prefix %s", statpath)); ++ return 1; ++ } ++ ++ rewritelog((r, 3, NULL, "prefix_stat compare statpath %s and lastsub output %s STATOK %d ", ++ statpath, lastsub->output, lastsub->flags & RULEFLAG_UNSAFE_PREFIX_STAT)); ++ if (lastsub->flags & RULEFLAG_UNSAFE_PREFIX_STAT) { ++ return 1; ++ } ++ else { ++ const char *docroot = ap_document_root(r); ++ const char *context_docroot = ap_context_document_root(r); ++ /* ++ * As an example, path (r->filename) is /var/foo/bar/baz.html ++ * even if the flag is not set, we can accept a rule that ++ * began with a literal /var (stapath), or if the entire path ++ * starts with the docroot or context document root ++ */ ++ if (startsWith(r, lastsub->output, statpath) || ++ startsWith(r, path, docroot) || ++ ((docroot != context_docroot) && ++ startsWith(r, path, context_docroot))) { ++ return 1; ++ } ++ } + } + } + ++ /* prefix will be added */ + return 0; + } + +@@ -3046,6 +3088,9 @@ static const char *cmd_rewriteoptions(cmd_parms *cmd, + else if (!strcasecmp(w, "legacyprefixdocroot")) { + options |= OPTION_LEGACY_PREFIX_DOCROOT; + } ++ else if (!strcasecmp(w, "UnsafePrefixStat")) { ++ options |= OPTION_UNSAFE_PREFIX_STAT; ++ } + else { + return apr_pstrcat(cmd->pool, "RewriteOptions: unknown option '", + w, "'", NULL); +@@ -3752,6 +3797,18 @@ static const char *cmd_rewriterule_setflag(apr_pool_t *p, void *_cfg, + ++error; + } + break; ++ case 'u': ++ case 'U': ++ if (!strcasecmp(key, "nsafePrefixStat")){ ++ cfg->flags |= (RULEFLAG_UNSAFE_PREFIX_STAT); ++ } ++ else if(!strcasecmp(key, "nsafeAllow3F")) { ++ cfg->flags |= RULEFLAG_UNSAFE_ALLOW3F; ++ } ++ else { ++ ++error; ++ } ++ break; + default: + ++error; + break; +@@ -4102,7 +4159,8 @@ static APR_INLINE void force_type_handler(rewriterule_entry *p, + /* + * Apply a single RewriteRule + */ +-static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) ++static rule_return_type apply_rewrite_rule(rewriterule_entry *p, ++ rewrite_ctx *ctx) + { + ap_regmatch_t regmatch[AP_MAX_REG_MATCH]; + apr_array_header_t *rewriteconds; +@@ -4153,7 +4211,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + rc = !ap_regexec(p->regexp, ctx->uri, AP_MAX_REG_MATCH, regmatch, 0); + if (! (( rc && !(p->flags & RULEFLAG_NOTMATCH)) || + (!rc && (p->flags & RULEFLAG_NOTMATCH)) ) ) { +- return 0; ++ return RULE_RC_NOMATCH; + } + + /* It matched, wow! Now it's time to prepare the context structure for +@@ -4204,7 +4262,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + } + } + else if (!rc) { +- return 0; ++ return RULE_RC_NOMATCH; + } + + /* If some HTTP header was involved in the condition, remember it +@@ -4224,6 +4282,15 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + newuri = do_expand(p->output, ctx, p); + rewritelog((r, 2, ctx->perdir, "rewrite '%s' -> '%s'", ctx->uri, + newuri)); ++ if (!(p->flags & RULEFLAG_UNSAFE_ALLOW3F) && ++ ap_strcasestr(r->unparsed_uri, "%3f") && ++ ap_strchr_c(newuri, '?')) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO() ++ "Unsafe URL with %%3f URL rewritten without " ++ "UnsafeAllow3F"); ++ r->status = HTTP_FORBIDDEN; ++ return RULE_RC_STATUS_SET; ++ } + } + + /* expand [E=var:val] and [CO=] */ +@@ -4241,7 +4308,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + r->status = p->forced_responsecode; + } + +- return 2; ++ return RULE_RC_NOSUB; + } + + /* Now adjust API's knowledge about r->filename and r->args */ +@@ -4293,7 +4360,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + r->filename)); + + r->filename = apr_pstrcat(r->pool, "proxy:", r->filename, NULL); +- return 1; ++ return RULE_RC_MATCH; + } + + /* If this rule is explicitly forced for HTTP redirection +@@ -4308,7 +4375,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + r->filename)); + + r->status = p->forced_responsecode; +- return 1; ++ return RULE_RC_MATCH; + } + + /* Special Rewriting Feature: Self-Reduction +@@ -4330,7 +4397,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + "with %s", p->forced_responsecode, r->filename)); + + r->status = p->forced_responsecode; +- return 1; ++ return RULE_RC_MATCH; + } + + /* Finally remember the forced mime-type */ +@@ -4339,7 +4406,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + /* Puuhhhhhhhh... WHAT COMPLICATED STUFF ;_) + * But now we're done for this particular rule. + */ +- return 1; ++ return RULE_RC_MATCH; + } + + /* +@@ -4347,13 +4414,13 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + * i.e. a list of rewrite rules + */ + static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules, +- char *perdir) ++ char *perdir, rewriterule_entry **lastsub) + { + rewriterule_entry *entries; + rewriterule_entry *p; + int i; + int changed; +- int rc; ++ rule_return_type rc; + int s; + rewrite_ctx *ctx; + int round = 1; +@@ -4361,6 +4428,7 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules, + ctx = apr_palloc(r->pool, sizeof(*ctx)); + ctx->perdir = perdir; + ctx->r = r; ++ *lastsub = NULL; + + /* + * Iterate over all existing rules +@@ -4388,7 +4456,12 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules, + ctx->vary = NULL; + rc = apply_rewrite_rule(p, ctx); + +- if (rc) { ++ if (rc != RULE_RC_NOMATCH) { ++ ++ if (!(p->flags & RULEFLAG_NOSUB)) { ++ rewritelog((r, 2, perdir, "setting lastsub to rule with output %s", p->output)); ++ *lastsub = p; ++ } + + /* Catch looping rules with pathinfo growing unbounded */ + if ( strlen( r->filename ) > 2*r->server->limit_req_line ) { +@@ -4408,6 +4481,12 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules, + apr_table_merge(r->headers_out, "Vary", ctx->vary); + } + ++ ++ /* Error while evaluating rule, r->status set */ ++ if (RULE_RC_STATUS_SET == rc) { ++ return ACTION_STATUS_SET; ++ } ++ + /* + * The rule sets the response code (implies match-only) + */ +@@ -4418,7 +4497,7 @@ static int apply_rewrite_list(request_rec *r, apr_array_header_t *rewriterules, + /* + * Indicate a change if this was not a match-only rule. + */ +- if (rc != 2) { ++ if (rc != RULE_RC_NOSUB) { + changed = ((p->flags & RULEFLAG_NOESCAPE) + ? ACTION_NOESCAPE : ACTION_NORMAL); + } +@@ -4607,6 +4686,7 @@ static int hook_uri2file(request_rec *r) + int rulestatus; + void *skipdata; + const char *oargs; ++ rewriterule_entry *lastsub = NULL; + + /* + * retrieve the config structures +@@ -4718,7 +4798,7 @@ static int hook_uri2file(request_rec *r) + /* + * now apply the rules ... + */ +- rulestatus = apply_rewrite_list(r, conf->rewriterules, NULL); ++ rulestatus = apply_rewrite_list(r, conf->rewriterules, NULL, &lastsub); + apr_table_setn(r->notes, "mod_rewrite_rewritten", + apr_psprintf(r->pool,"%d",rulestatus)); + } +@@ -4756,6 +4836,9 @@ static int hook_uri2file(request_rec *r) + r->status = HTTP_OK; + return n; + } ++ else if (ACTION_STATUS_SET == rulestatus) { ++ return r->status; ++ } + + if (to_proxyreq) { + /* it should be go on as an internal proxy request */ +@@ -4875,23 +4958,29 @@ static int hook_uri2file(request_rec *r) + return HTTP_BAD_REQUEST; + } + +- /* if there is no valid prefix, we call +- * the translator from the core and +- * prefix the filename with document_root ++ /* We have r->filename as a path in a server-context rewrite without ++ * the PT flag. The historical behavior is to treat it as a verbatim ++ * filesystem path iff the first component of the path exists and is ++ * readable by httpd. Otherwise, it is interpreted as DocumentRoot ++ * relative. + * + * NOTICE: + * We cannot leave out the prefix_stat because +- * - when we always prefix with document_root +- * then no absolute path can be created, e.g. via +- * emulating a ScriptAlias directive, etc. +- * - when we always NOT prefix with document_root ++ * - If we always prefix with document_root ++ * then no absolute path can could ever be used in ++ * a substitution. e.g. emulating an Alias. ++ * - If we never prefix with document_root + * then the files under document_root have to + * be references directly and document_root + * gets never used and will be a dummy parameter - +- * this is also bad ++ * this is also bad. ++ * - Later addition: This part is questionable. ++ * If we had never prefixed, users would just ++ * need %{DOCUMENT_ROOT} in substitutions or the ++ * [PT] flag. + * + * BUT: +- * Under real Unix systems this is no problem, ++ * Under real Unix systems this is no perf problem, + * because we only do stat() on the first directory + * and this gets cached by the kernel for along time! + */ +@@ -4900,7 +4989,9 @@ static int hook_uri2file(request_rec *r) + uri_reduced = apr_table_get(r->notes, "mod_rewrite_uri_reduced"); + } + +- if (!prefix_stat(r->filename, r->pool) || uri_reduced != NULL) { ++ if (!prefix_stat(r, r->filename, r->pool, ++ conf->options & OPTION_UNSAFE_PREFIX_STAT ? NULL : lastsub) ++ || uri_reduced != NULL) { + int res; + char *tmp = r->uri; + +@@ -4945,6 +5036,7 @@ static int hook_fixup(request_rec *r) + char *ofilename, *oargs; + int is_proxyreq; + void *skipdata; ++ rewriterule_entry *lastsub; + + dconf = (rewrite_perdir_conf *)ap_get_module_config(r->per_dir_config, + &rewrite_module); +@@ -5029,7 +5121,7 @@ static int hook_fixup(request_rec *r) + /* + * now apply the rules ... + */ +- rulestatus = apply_rewrite_list(r, dconf->rewriterules, dconf->directory); ++ rulestatus = apply_rewrite_list(r, dconf->rewriterules, dconf->directory, &lastsub); + if (rulestatus) { + unsigned skip_absolute = is_absolute_uri(r->filename, NULL); + int to_proxyreq = 0; +@@ -5058,6 +5150,9 @@ static int hook_fixup(request_rec *r) + r->status = HTTP_OK; + return n; + } ++ else if (ACTION_STATUS_SET == rulestatus) { ++ return r->status; ++ } + + if (to_proxyreq) { + /* it should go on as an internal proxy request */ diff --git a/SOURCES/httpd-2.4.37-CVE-2024-38477.patch b/SOURCES/httpd-2.4.37-CVE-2024-38477.patch new file mode 100644 index 0000000..38dc2db --- /dev/null +++ b/SOURCES/httpd-2.4.37-CVE-2024-38477.patch @@ -0,0 +1,29 @@ +diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c +index 6244e74..f5c3283 100644 +--- a/modules/proxy/proxy_util.c ++++ b/modules/proxy/proxy_util.c +@@ -2406,6 +2406,13 @@ ap_proxy_determine_connection(apr_pool_t *p, request_rec *r, + apr_pstrcat(p,"URI cannot be parsed: ", *url, + NULL)); + } ++ ++ if (!uri->hostname) { ++ return ap_proxyerror(r, HTTP_BAD_REQUEST, ++ apr_pstrcat(p,"URI has no hostname: ", *url, ++ NULL)); ++ } ++ + if (!uri->port) { + uri->port = ap_proxy_port_of_scheme(uri->scheme); + } +@@ -3727,6 +3734,10 @@ PROXY_DECLARE(int) ap_proxy_create_hdrbrgd(apr_pool_t *p, + * way. No telling which legacy backend is relying no this. + */ + if (dconf->preserve_host == 0) { ++ if (!uri->hostname) { ++ rc = HTTP_BAD_REQUEST; ++ goto cleanup; ++ } + if (ap_strchr_c(uri->hostname, ':')) { /* if literal IPv6 address */ + if (uri->port_str && uri->port != DEFAULT_HTTP_PORT) { + buf = apr_pstrcat(p, "Host: [", uri->hostname, "]:", diff --git a/SOURCES/httpd-2.4.37-CVE-2024-39573.patch b/SOURCES/httpd-2.4.37-CVE-2024-39573.patch new file mode 100644 index 0000000..e472b5e --- /dev/null +++ b/SOURCES/httpd-2.4.37-CVE-2024-39573.patch @@ -0,0 +1,56 @@ +diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c +index 797f093..114b126 100644 +--- a/modules/mappers/mod_rewrite.c ++++ b/modules/mappers/mod_rewrite.c +@@ -4311,6 +4311,32 @@ static rule_return_type apply_rewrite_rule(rewriterule_entry *p, + return RULE_RC_NOSUB; + } + ++ /* Add the previously stripped per-directory location prefix, unless ++ * (1) it's an absolute URL path and ++ * (2) it's a full qualified URL ++ */ ++ if (!is_proxyreq && *newuri != '/' && !is_absolute_uri(newuri, NULL)) { ++ if (ctx->perdir) { ++ rewritelog((r, 3, ctx->perdir, "add per-dir prefix: %s -> %s%s", ++ newuri, ctx->perdir, newuri)); ++ ++ newuri = apr_pstrcat(r->pool, ctx->perdir, newuri, NULL); ++ } ++ else if (!(p->flags & (RULEFLAG_PROXY | RULEFLAG_FORCEREDIRECT))) { ++ /* Not an absolute URI-path and the scheme (if any) is unknown, ++ * and it won't be passed to fully_qualify_uri() below either, ++ * so add an implicit '/' prefix. This avoids potentially a common ++ * rule like "RewriteRule ^/some/path(.*) $1" that is given a path ++ * like "/some/pathscheme:..." to produce the fully qualified URL ++ * "scheme:..." which could be misinterpreted later. ++ */ ++ rewritelog((r, 3, ctx->perdir, "add root prefix: %s -> /%s", ++ newuri, newuri)); ++ ++ newuri = apr_pstrcat(r->pool, "/", newuri, NULL); ++ } ++ } ++ + /* Now adjust API's knowledge about r->filename and r->args */ + r->filename = newuri; + +@@ -4320,18 +4346,6 @@ static rule_return_type apply_rewrite_rule(rewriterule_entry *p, + + splitout_queryargs(r, p->flags); + +- /* Add the previously stripped per-directory location prefix, unless +- * (1) it's an absolute URL path and +- * (2) it's a full qualified URL +- */ +- if ( ctx->perdir && !is_proxyreq && *r->filename != '/' +- && !is_absolute_uri(r->filename, NULL)) { +- rewritelog((r, 3, ctx->perdir, "add per-dir prefix: %s -> %s%s", +- r->filename, ctx->perdir, r->filename)); +- +- r->filename = apr_pstrcat(r->pool, ctx->perdir, r->filename, NULL); +- } +- + /* If this rule is forced for proxy throughput + * (`RewriteRule ... ... [P]') then emulate mod_proxy's + * URL-to-filename handler to be sure mod_proxy is triggered diff --git a/SPECS/httpd.spec b/SPECS/httpd.spec index 2b2e7a0..6c15e25 100644 --- a/SPECS/httpd.spec +++ b/SPECS/httpd.spec @@ -13,7 +13,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.37 -Release: 65%{?dist} +Release: 65%{?dist}.1 URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source2: httpd.logrotate @@ -260,6 +260,16 @@ Patch239: httpd-2.4.37-CVE-2023-27522.patch Patch240: httpd-2.4.37-CVE-2023-31122.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2273491 Patch241: httpd-2.4.37-CVE-2023-38709.patch +# CVE-2024-38474 and CVE-2024-38475 fixed in one patch +# https://bugzilla.redhat.com/show_bug.cgi?id=2295013 +# https://bugzilla.redhat.com/show_bug.cgi?id=2295014 +Patch242: httpd-2.4.37-CVE-2024-38474+.patch +# https://bugzilla.redhat.com/show_bug.cgi?id=2295012 +Patch243: httpd-2.4.37-CVE-2024-38473.patch +# https://bugzilla.redhat.com/show_bug.cgi?id=2295016 +Patch244: httpd-2.4.37-CVE-2024-38477.patch +# https://bugzilla.redhat.com/show_bug.cgi?id=2295022 +Patch245: httpd-2.4.37-CVE-2024-39573.patch License: ASL 2.0 Group: System Environment/Daemons @@ -487,6 +497,10 @@ interface for storing and accessing per-user session data. %patch239 -p1 -b .CVE-2023-27522 %patch240 -p1 -b .CVE-2023-31122 %patch241 -p1 -b .CVE-2023-38709 +%patch242 -p1 -b .CVE-2024-38474+ +%patch243 -p1 -b .CVE-2024-38473 +%patch244 -p1 -b .CVE-2024-38477 +%patch245 -p1 -b .CVE-2024-39573 # Patch in the vendor string sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h @@ -992,6 +1006,18 @@ rm -rf $RPM_BUILD_ROOT %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Jul 11 2024 Luboš Uhliarik - 2.4.37-65.1 +- Resolves: RHEL-45812 - httpd:2.4/httpd: Substitution encoding issue + in mod_rewrite (CVE-2024-38474) +- Resolves: RHEL-45785 - httpd:2.4/httpd: Encoding problem in + mod_proxy (CVE-2024-38473) +- Resolves: RHEL-45777 - httpd:2.4/httpd: Improper escaping of output + in mod_rewrite (CVE-2024-38475) +- Resolves: RHEL-45758 - httpd:2.4/httpd: null pointer dereference + in mod_proxy (CVE-2024-38477) +- Resolves: RHEL-45743 - httpd:2.4/httpd: Potential SSRF + in mod_rewrite (CVE-2024-39573) + * Wed Jun 12 2024 Luboš Uhliarik - 2.4.37-65 - Resolves: RHEL-31857 - httpd:2.4/httpd: HTTP response splitting (CVE-2023-38709)