rpms/httpd
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import CS git httpd-2.4.37-65.el8.8

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-05-31 23:26:45 -04:00
parent d31560dca2
commit 6b1ccdd733
6 changed files with 162 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
SOURCES/httpd-2.4.37-CVE-2026-28780.patch Normal file
View File

@ -0,0 +1,33 @@
From d04119e6e591f7b21222e749387a8b39e9092a1b Mon Sep 17 00:00:00 2001
From: Eric Covener <covener@apache.org>
Date: Sun, 26 Apr 2026 15:57:55 +0000
Subject: [PATCH] Merge r1933347 from trunk:
fix ajp_msg_check_header check
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1933348 13f79535-47bb-0310-9956-ffa450edef68
---
modules/proxy/ajp_msg.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/modules/proxy/ajp_msg.c b/modules/proxy/ajp_msg.c
index 3d4186a521c..3454f621828 100644
--- a/modules/proxy/ajp_msg.c
+++ b/modules/proxy/ajp_msg.c
@@ -166,11 +166,11 @@ apr_status_t ajp_msg_check_header(ajp_msg_t *msg, apr_size_t *len)
msglen = ((head[2] & 0xff) << 8);
msglen += (head[3] & 0xFF);
- if (msglen > msg->max_size) {
+ if (msglen > (msg->max_size - AJP_HEADER_LEN)) {
ap_log_error(APLOG_MARK, APLOG_ERR, 0, NULL, APLOGNO(01081)
"ajp_msg_check_header() incoming message is "
"too big %" APR_SIZE_T_FMT ", max is %" APR_SIZE_T_FMT,
- msglen, msg->max_size);
+ msglen, msg->max_size - AJP_HEADER_LEN);
return AJP_ETOBIG;
}

18
SOURCES/httpd-2.4.37-CVE-2026-33007.patch Normal file
View File

@ -0,0 +1,18 @@
diff --git a/modules/aaa/mod_authn_socache.c b/modules/aaa/mod_authn_socache.c
index 550bc66..9b921b8 100644
--- a/modules/aaa/mod_authn_socache.c
+++ b/modules/aaa/mod_authn_socache.c
@@ -266,11 +266,10 @@ static const command_rec authn_cache_cmds[] =
static const char *construct_key(request_rec *r, const char *context,
const char *user, const char *realm)
{
+ const char *slash = ap_strrchr_c(r->uri, '/');
/* handle "special" context values */
- if (!strcmp(context, directory)) {
- /* FIXME: are we at risk of this blowing up? */
+ if (!strcmp(context, directory) && slash) {
char *new_context;
- char *slash = strrchr(r->uri, '/');
new_context = apr_palloc(r->pool, slash - r->uri +
strlen(r->server->server_hostname) + 1);
strcpy(new_context, r->server->server_hostname);

49
SOURCES/httpd-2.4.37-CVE-2026-33857.patch Normal file
View File

@ -0,0 +1,49 @@
diff --git a/modules/proxy/ajp_msg.c b/modules/proxy/ajp_msg.c
index a1c009f..6443b36 100644
--- a/modules/proxy/ajp_msg.c
+++ b/modules/proxy/ajp_msg.c
@@ -395,7 +395,7 @@ apr_status_t ajp_msg_get_uint32(ajp_msg_t *msg, apr_uint32_t *rvalue)
{
apr_uint32_t value;
- if ((msg->pos + 3) > msg->len) {
+ if ((msg->pos + 3) >= msg->len) {
return ajp_log_overflow(msg, "ajp_msg_get_uint32");
}
@@ -420,7 +420,7 @@ apr_status_t ajp_msg_get_uint16(ajp_msg_t *msg, apr_uint16_t *rvalue)
{
apr_uint16_t value;
- if ((msg->pos + 1) > msg->len) {
+ if ((msg->pos + 1) >= msg->len) {
return ajp_log_overflow(msg, "ajp_msg_get_uint16");
}
@@ -443,7 +443,7 @@ apr_status_t ajp_msg_peek_uint16(ajp_msg_t *msg, apr_uint16_t *rvalue)
{
apr_uint16_t value;
- if ((msg->pos + 1) > msg->len) {
+ if ((msg->pos + 1) >= msg->len) {
return ajp_log_overflow(msg, "ajp_msg_peek_uint16");
}
@@ -464,7 +464,7 @@ apr_status_t ajp_msg_peek_uint16(ajp_msg_t *msg, apr_uint16_t *rvalue)
*/
apr_status_t ajp_msg_peek_uint8(ajp_msg_t *msg, apr_byte_t *rvalue)
{
- if (msg->pos > msg->len) {
+ if (msg->pos >= msg->len) {
return ajp_log_overflow(msg, "ajp_msg_peek_uint8");
}
@@ -482,7 +482,7 @@ apr_status_t ajp_msg_peek_uint8(ajp_msg_t *msg, apr_byte_t *rvalue)
apr_status_t ajp_msg_get_uint8(ajp_msg_t *msg, apr_byte_t *rvalue)
{
- if (msg->pos > msg->len) {
+ if (msg->pos >= msg->len) {
return ajp_log_overflow(msg, "ajp_msg_get_uint8");
}

18
SOURCES/httpd-2.4.37-CVE-2026-34032.patch Normal file
View File

@ -0,0 +1,18 @@
diff --git a/modules/proxy/ajp_msg.c b/modules/proxy/ajp_msg.c
index 6443b36..3454f62 100644
--- a/modules/proxy/ajp_msg.c
+++ b/modules/proxy/ajp_msg.c
@@ -507,7 +507,12 @@ apr_status_t ajp_msg_get_string(ajp_msg_t *msg, const char **rvalue)
status = ajp_msg_get_uint16(msg, &size);
start = msg->pos;
- if ((status != APR_SUCCESS) || (size + start > msg->max_size)) {
+ if ((status != APR_SUCCESS) || (size + start >= msg->len)) {
+ return ajp_log_overflow(msg, "ajp_msg_get_string");
+ }
+
+ /* Verify that the expected null terminator is actually present */
+ if (msg->buf[start + size] != '\0') {
return ajp_log_overflow(msg, "ajp_msg_get_string");
}

16
SOURCES/httpd-2.4.37-CVE-2026-34059.patch Normal file
View File

@ -0,0 +1,16 @@
diff --git a/modules/proxy/ajp_header.c b/modules/proxy/ajp_header.c
index 680a8f3..768ffbb 100644
--- a/modules/proxy/ajp_header.c
+++ b/modules/proxy/ajp_header.c
@@ -817,6 +817,11 @@ apr_status_t ajp_parse_data(request_rec *r, ajp_msg_t *msg,
* 1 : The last byte of this message always seems to be
* 0x00 and is not part of the chunk.
*/
+ if (msg->len < AJP_HEADER_LEN + AJP_HEADER_SZ_LEN + 1 + 1) {
+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10546)
+ "ajp_parse_data: Message too small");
+ return AJP_EBAD_HEADER;
+ }
expected_len = msg->len - (AJP_HEADER_LEN + AJP_HEADER_SZ_LEN + 1 + 1);
if (*len != expected_len) {
ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(00998)

29
SPECS/httpd.spec
View File

@ -14,7 +14,7 @@
Summary: Apache HTTP Server
Name: httpd
Version: 2.4.37
Release: 65%{?dist}.7
Release: 65%{?dist}.8
URL: https://httpd.apache.org/
Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
Source2: httpd.logrotate
@ -299,6 +299,16 @@ Patch252: httpd-2.4.37-CVE-2025-66200.patch
Patch253: httpd-2.4.37-CVE-2025-65082.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=2419365
Patch254: httpd-2.4.37-CVE-2025-58098.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=2466913
Patch255: httpd-2.4.37-CVE-2026-28780.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=2465299
Patch256: httpd-2.4.37-CVE-2026-33007.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=2464953
Patch257: httpd-2.4.37-CVE-2026-33857.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=2464952
Patch258: httpd-2.4.37-CVE-2026-34032.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=2464940
Patch259: httpd-2.4.37-CVE-2026-34059.patch
License: ASL 2.0
Group: System Environment/Daemons
@ -543,6 +553,11 @@ interface for storing and accessing per-user session data.
%patch252 -p1 -b .CVE-2025-66200
%patch253 -p1 -b .CVE-2025-65082
%patch254 -p1 -b .CVE-2025-58098
%patch255 -p1 -b .CVE-2026-28780
%patch256 -p1 -b .CVE-2026-33007
%patch257 -p1 -b .CVE-2026-33857
%patch258 -p1 -b .CVE-2026-34032
%patch259 -p1 -b .CVE-2026-34059
%patch96 -p1 -b .r1922080
@ -1054,6 +1069,18 @@ rm -rf $RPM_BUILD_ROOT
%{_rpmconfigdir}/macros.d/macros.httpd
%changelog
* Tue May 12 2026 Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-65.8
- Resolves: RHEL-173558 - httpd:2.4/httpd: Apache HTTP Server mod_proxy_ajp:
Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780)
- Resolves: RHEL-175074 - httpd:2.4/httpd: NULL pointer dereference can
cause a child process crash (CVE-2026-33007)
- Resolves: RHEL-175088 - httpd:2.4/httpd: off-by-one out-of-bounds reads
in AJP getter functions (CVE-2026-33857)
- Resolves: RHEL-175620 - httpd:2.4/httpd: NULL pointer dereference via
specially crafted request (CVE-2026-29169)
- Resolves: RHEL-175055 - httpd: heap-based buffer over-read and memory
disclosure in ajp_parse_data() (CVE-2026-34059)
* Fri Dec 12 2025 Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-65.7
- Resolves: RHEL-135054 - httpd: Apache HTTP Server: mod_userdir+suexec bypass
via AllowOverride FileInfo (CVE-2025-66200)