rpms/httpd
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import UBI httpd-2.4.63-13.el10_2.5

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-08-04 15:14:30 -04:00
parent 192c38ea60
commit dfee05d929
2 changed files with 24 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
httpd-2.4.63-CVE-2026-34355.patch
View File

@ -1,5 +1,5 @@
diff --git a/modules/filters/mod_proxy_html.c b/modules/filters/mod_proxy_html.c
index 4205a61..27614fe 100644
index 4205a61..d4591bd 100644
--- a/modules/filters/mod_proxy_html.c
+++ b/modules/filters/mod_proxy_html.c
@@ -63,6 +63,7 @@
@ -214,7 +214,7 @@ index 4205a61..27614fe 100644
}
else {
/* not sure if this should force-flush
@@ -324,9 +301,9 @@ static void pcomment(void *ctxt, const xmlChar *uchars)
@@ -324,15 +301,14 @@ static void pcomment(void *ctxt, const xmlChar *uchars)
return;
if (ctx->cfg->extfix) {
@ -227,7 +227,13 @@ index 4205a61..27614fe 100644
}
else {
ap_fputs(ctx->f->next, ctx->bb, "<!--");
@@ -356,9 +333,9 @@ static void pendElement(void *ctxt, const xmlChar *uname)
AP_fwrite(ctx, chars, strlen(chars), 1);
ap_fputs(ctx->f->next, ctx->bb, "-->");
- dump_content(ctx);
}
}
static void pendElement(void *ctxt, const xmlChar *uname)
@@ -356,9 +332,9 @@ static void pendElement(void *ctxt, const xmlChar *uname)
/* TODO - implement HTML "allowed here" using the stack */
/* nah. Keeping the stack is too much overhead */
@ -239,7 +245,7 @@ index 4205a61..27614fe 100644
}
if (!desc || !desc->empty) {
ap_fprintf(ctx->f->next, ctx->bb, "</%s>", name);
@@ -371,7 +348,6 @@ static void pstartElement(void *ctxt, const xmlChar *uname,
@@ -371,7 +347,6 @@ static void pstartElement(void *ctxt, const xmlChar *uname,
int required_attrs;
int num_match;
size_t offs, len;
@ -247,7 +253,7 @@ index 4205a61..27614fe 100644
rewrite_t is_uri;
const char** a;
urlmap *m;
@@ -389,6 +365,7 @@ static void pstartElement(void *ctxt, const xmlChar *uname,
@@ -389,6 +364,7 @@ static void pstartElement(void *ctxt, const xmlChar *uname,
const char** attrs = (const char**) uattrs;
const htmlElemDesc* desc = htmlTagLookup(uname);
urlmap *themap = ctx->map;
@ -255,7 +261,7 @@ index 4205a61..27614fe 100644
#ifdef HAVE_STACK
const void** descp;
#endif
@@ -418,6 +395,8 @@ static void pstartElement(void *ctxt, const xmlChar *uname,
@@ -418,6 +394,8 @@ static void pstartElement(void *ctxt, const xmlChar *uname,
/* TODO - implement HTML "allowed here" */
#endif
@ -264,7 +270,7 @@ index 4205a61..27614fe 100644
ap_fputc(ctx->f->next, ctx->bb, '<');
ap_fputs(ctx->f->next, ctx->bb, name);
@@ -448,9 +427,10 @@ static void pstartElement(void *ctxt, const xmlChar *uname,
@@ -448,9 +426,10 @@ static void pstartElement(void *ctxt, const xmlChar *uname,
break;
}
}
@ -277,7 +283,7 @@ index 4205a61..27614fe 100644
is_uri = ATTR_IGNORE;
if (linkattrs) {
tattr *attrs = (tattr*) linkattrs->elts;
@@ -479,59 +459,53 @@ static void pstartElement(void *ctxt, const xmlChar *uname,
@@ -479,59 +458,53 @@ static void pstartElement(void *ctxt, const xmlChar *uname,
continue;
if (m->flags & M_REGEX) {
nmatch = 10;
@ -360,7 +366,7 @@ index 4205a61..27614fe 100644
break;
}
}
@@ -546,79 +520,73 @@ static void pstartElement(void *ctxt, const xmlChar *uname,
@@ -546,79 +519,73 @@ static void pstartElement(void *ctxt, const xmlChar *uname,
if (!(m->flags & M_EVENTS))
continue;
if (m->flags & M_REGEX) {
@ -470,7 +476,7 @@ index 4205a61..27614fe 100644
++num_match;
}
}
@@ -635,18 +603,18 @@ static void pstartElement(void *ctxt, const xmlChar *uname,
@@ -635,18 +602,18 @@ static void pstartElement(void *ctxt, const xmlChar *uname,
else {
if (ctx->cfg->flags != 0)
@ -492,7 +498,7 @@ index 4205a61..27614fe 100644
if (desc && desc->empty)
ap_fputs(ctx->f->next, ctx->bb, ctx->cfg->etag);
else
@@ -658,6 +626,7 @@ static void pstartElement(void *ctxt, const xmlChar *uname,
@@ -658,6 +625,7 @@ static void pstartElement(void *ctxt, const xmlChar *uname,
"HTML element %s is missing %d required attributes",
name, required_attrs);
}
@ -500,7 +506,7 @@ index 4205a61..27614fe 100644
}
static meta *metafix(request_rec *r, const char *buf, apr_size_t len)
@@ -826,6 +795,8 @@ static saxctxt *check_filter_init (ap_filter_t *f)
@@ -826,6 +794,8 @@ static saxctxt *check_filter_init (ap_filter_t *f)
proxy_html_conf *cfg;
const char *force;
const char *errmsg = NULL;
@ -509,7 +515,7 @@ index 4205a61..27614fe 100644
cfg = ap_get_module_config(f->r->per_dir_config, &proxy_html_module);
force = apr_table_get(f->r->subprocess_env, "PROXY_HTML_FORCE");
@@ -859,6 +830,8 @@ static saxctxt *check_filter_init (ap_filter_t *f)
@@ -859,6 +829,8 @@ static saxctxt *check_filter_init (ap_filter_t *f)
fctx->bb = apr_brigade_create(f->r->pool,
f->r->connection->bucket_alloc);
fctx->cfg = cfg;
@ -518,7 +524,7 @@ index 4205a61..27614fe 100644
apr_table_unset(f->r->headers_out, "Content-Length");
if (cfg->interp)
@@ -1028,7 +1001,7 @@ static void *proxy_html_config(apr_pool_t *pool, char *x)
@@ -1028,7 +1000,7 @@ static void *proxy_html_config(apr_pool_t *pool, char *x)
proxy_html_conf *ret = apr_pcalloc(pool, sizeof(proxy_html_conf));
ret->doctype = DEFAULT_DOCTYPE;
ret->etag = DEFAULT_ETAG;

5
httpd.spec
View File

@ -25,7 +25,7 @@
Summary: Apache HTTP Server
Name: httpd
Version: 2.4.63
Release: 13%{?dist}.4
Release: 13%{?dist}.5
URL: https://httpd.apache.org/
Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@ -886,6 +886,9 @@ exit $rv
%{_rpmconfigdir}/macros.d/macros.httpd
%changelog
* Thu Jul 09 2026 Luboš Uhliarik <luhliari@redhat.com> - 2.4.63-13.5
- Resolves: RHEL-192750 - mod_proxy_html regression in CVE-2026-34355 fix
* Tue Jun 23 2026 Luboš Uhliarik <luhliari@redhat.com> - 2.4.63-13.4
- Resolves: RHEL-186221 - httpd: Apache HTTP Server: Heap-based Buffer Overflow
via malicious backend servers (CVE-2026-34356)