From cd639fe99fe663ca532a14469b12f6f2068a69bf Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Tue, 25 Aug 2026 07:39:45 -0400 Subject: [PATCH] import UBI httpd-2.4.62-13.el9_8.6 --- SOURCES/httpd-2.4.62-CVE-2026-29167.patch | 46 +++++++++++++++++++++++ SPECS/httpd.spec | 10 ++++- 2 files changed, 55 insertions(+), 1 deletion(-) create mode 100644 SOURCES/httpd-2.4.62-CVE-2026-29167.patch diff --git a/SOURCES/httpd-2.4.62-CVE-2026-29167.patch b/SOURCES/httpd-2.4.62-CVE-2026-29167.patch new file mode 100644 index 0000000..f401112 --- /dev/null +++ b/SOURCES/httpd-2.4.62-CVE-2026-29167.patch @@ -0,0 +1,46 @@ +From 88568e901f41fdd527d180970f7f372f88b93260 Mon Sep 17 00:00:00 2001 +From: Joe Orton +Date: Wed, 3 Jun 2026 17:09:40 +0000 +Subject: [PATCH] Merge r1934932 from trunk: + +* modules/ldap/util_ldap.c (uldap_connection_find): Fix inheritance in + per-dir context. + +Reviewed by: jorton, covener, jfclere + + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1934935 13f79535-47bb-0310-9956-ffa450edef68 +--- + modules/ldap/util_ldap.c | 19 +++++++++++++++++-- + 1 file changed, 17 insertions(+), 2 deletions(-) + +diff --git a/modules/ldap/util_ldap.c b/modules/ldap/util_ldap.c +index 8c9e58717d..0f13d912c3 100644 +--- a/modules/ldap/util_ldap.c ++++ b/modules/ldap/util_ldap.c +@@ -897,8 +897,23 @@ static util_ldap_connection_t * + */ + l->secure = secureflag; + +- /* save away a copy of the client cert list that is presently valid */ +- l->client_certs = apr_array_copy_hdr(l->pool, dc->client_certs); ++ /* Deep-copy the client cert list into the connection pool so that ++ * the cached connection does not retain pointers into the ++ * (potentially short-lived) per-directory config pool. ++ */ ++ l->client_certs = apr_array_copy(l->pool, dc->client_certs); ++ if (!apr_is_empty_array(l->client_certs)) { ++ int i; ++ apr_ldap_opt_tls_cert_t *certs; ++ ++ certs = (apr_ldap_opt_tls_cert_t *)l->client_certs->elts; ++ for (i = 0; i < l->client_certs->nelts; i++) { ++ if (certs[i].path) ++ certs[i].path = apr_pstrdup(l->pool, certs[i].path); ++ if (certs[i].password) ++ certs[i].password = apr_pstrdup(l->pool, certs[i].password); ++ } ++ } + + /* whether or not to keep this connection in the pool when it's returned */ + l->keep = (st->connection_pool_ttl == 0) ? 0 : 1; diff --git a/SPECS/httpd.spec b/SPECS/httpd.spec index cf9bf8d..7e1ede7 100644 --- a/SPECS/httpd.spec +++ b/SPECS/httpd.spec @@ -14,7 +14,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.62 -Release: 13%{?dist}.5 +Release: 13%{?dist}.6 URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -163,6 +163,8 @@ Patch221: httpd-2.4.62-CVE-2026-42535.patch Patch222: httpd-2.4.62-CVE-2026-43951.patch Patch223: httpd-2.4.62-CVE-2026-44119.patch Patch224: httpd-2.4.62-CVE-2026-44186.patch +# https://github.com/apache/httpd/commit/2cf9b3f393633f43746047e779fdf265a1ad8016 +Patch225: httpd-2.4.62-CVE-2026-29167.patch License: ASL 2.0 BuildRequires: gcc, autoconf, pkgconfig, findutils, xmlto @@ -353,6 +355,7 @@ written in the Lua programming language. %patch222 -p1 -b .CVE-2026-43951 %patch223 -p1 -b .CVE-2026-44119 %patch224 -p1 -b .CVE-2026-44186 +%patch225 -p1 -b .CVE-2026-29167 # Patch in the vendor string sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h @@ -918,6 +921,11 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Aug 13 2026 RHEL Packaging Agent - 2.4.62-13.6 +- Resolves: RHEL-190807 - httpd: use-after-free in mod_ldap + uldap_connection_find via per-directory client cert list + (CVE-2026-29167) + * Thu Jul 09 2026 Luboš Uhliarik - 2.4.62-13.5 - Resolves: RHEL-192752 - mod_proxy_html regression in CVE-2026-34355 fix