diff --git a/httpd-2.4.63-CVE-2026-34355.patch b/httpd-2.4.63-CVE-2026-34355.patch index 8b816f8..59d7aec 100644 --- a/httpd-2.4.63-CVE-2026-34355.patch +++ b/httpd-2.4.63-CVE-2026-34355.patch @@ -1,5 +1,5 @@ diff --git a/modules/filters/mod_proxy_html.c b/modules/filters/mod_proxy_html.c -index 4205a61..27614fe 100644 +index 4205a61..d4591bd 100644 --- a/modules/filters/mod_proxy_html.c +++ b/modules/filters/mod_proxy_html.c @@ -63,6 +63,7 @@ @@ -214,7 +214,7 @@ index 4205a61..27614fe 100644 } else { /* not sure if this should force-flush -@@ -324,9 +301,9 @@ static void pcomment(void *ctxt, const xmlChar *uchars) +@@ -324,15 +301,14 @@ static void pcomment(void *ctxt, const xmlChar *uchars) return; if (ctx->cfg->extfix) { @@ -227,7 +227,13 @@ index 4205a61..27614fe 100644 } else { ap_fputs(ctx->f->next, ctx->bb, ""); +- dump_content(ctx); + } + } + static void pendElement(void *ctxt, const xmlChar *uname) +@@ -356,9 +332,9 @@ static void pendElement(void *ctxt, const xmlChar *uname) /* TODO - implement HTML "allowed here" using the stack */ /* nah. Keeping the stack is too much overhead */ @@ -239,7 +245,7 @@ index 4205a61..27614fe 100644 } if (!desc || !desc->empty) { ap_fprintf(ctx->f->next, ctx->bb, "", name); -@@ -371,7 +348,6 @@ static void pstartElement(void *ctxt, const xmlChar *uname, +@@ -371,7 +347,6 @@ static void pstartElement(void *ctxt, const xmlChar *uname, int required_attrs; int num_match; size_t offs, len; @@ -247,7 +253,7 @@ index 4205a61..27614fe 100644 rewrite_t is_uri; const char** a; urlmap *m; -@@ -389,6 +365,7 @@ static void pstartElement(void *ctxt, const xmlChar *uname, +@@ -389,6 +364,7 @@ static void pstartElement(void *ctxt, const xmlChar *uname, const char** attrs = (const char**) uattrs; const htmlElemDesc* desc = htmlTagLookup(uname); urlmap *themap = ctx->map; @@ -255,7 +261,7 @@ index 4205a61..27614fe 100644 #ifdef HAVE_STACK const void** descp; #endif -@@ -418,6 +395,8 @@ static void pstartElement(void *ctxt, const xmlChar *uname, +@@ -418,6 +394,8 @@ static void pstartElement(void *ctxt, const xmlChar *uname, /* TODO - implement HTML "allowed here" */ #endif @@ -264,7 +270,7 @@ index 4205a61..27614fe 100644 ap_fputc(ctx->f->next, ctx->bb, '<'); ap_fputs(ctx->f->next, ctx->bb, name); -@@ -448,9 +427,10 @@ static void pstartElement(void *ctxt, const xmlChar *uname, +@@ -448,9 +426,10 @@ static void pstartElement(void *ctxt, const xmlChar *uname, break; } } @@ -277,7 +283,7 @@ index 4205a61..27614fe 100644 is_uri = ATTR_IGNORE; if (linkattrs) { tattr *attrs = (tattr*) linkattrs->elts; -@@ -479,59 +459,53 @@ static void pstartElement(void *ctxt, const xmlChar *uname, +@@ -479,59 +458,53 @@ static void pstartElement(void *ctxt, const xmlChar *uname, continue; if (m->flags & M_REGEX) { nmatch = 10; @@ -360,7 +366,7 @@ index 4205a61..27614fe 100644 break; } } -@@ -546,79 +520,73 @@ static void pstartElement(void *ctxt, const xmlChar *uname, +@@ -546,79 +519,73 @@ static void pstartElement(void *ctxt, const xmlChar *uname, if (!(m->flags & M_EVENTS)) continue; if (m->flags & M_REGEX) { @@ -470,7 +476,7 @@ index 4205a61..27614fe 100644 ++num_match; } } -@@ -635,18 +603,18 @@ static void pstartElement(void *ctxt, const xmlChar *uname, +@@ -635,18 +602,18 @@ static void pstartElement(void *ctxt, const xmlChar *uname, else { if (ctx->cfg->flags != 0) @@ -492,7 +498,7 @@ index 4205a61..27614fe 100644 if (desc && desc->empty) ap_fputs(ctx->f->next, ctx->bb, ctx->cfg->etag); else -@@ -658,6 +626,7 @@ static void pstartElement(void *ctxt, const xmlChar *uname, +@@ -658,6 +625,7 @@ static void pstartElement(void *ctxt, const xmlChar *uname, "HTML element %s is missing %d required attributes", name, required_attrs); } @@ -500,7 +506,7 @@ index 4205a61..27614fe 100644 } static meta *metafix(request_rec *r, const char *buf, apr_size_t len) -@@ -826,6 +795,8 @@ static saxctxt *check_filter_init (ap_filter_t *f) +@@ -826,6 +794,8 @@ static saxctxt *check_filter_init (ap_filter_t *f) proxy_html_conf *cfg; const char *force; const char *errmsg = NULL; @@ -509,7 +515,7 @@ index 4205a61..27614fe 100644 cfg = ap_get_module_config(f->r->per_dir_config, &proxy_html_module); force = apr_table_get(f->r->subprocess_env, "PROXY_HTML_FORCE"); -@@ -859,6 +830,8 @@ static saxctxt *check_filter_init (ap_filter_t *f) +@@ -859,6 +829,8 @@ static saxctxt *check_filter_init (ap_filter_t *f) fctx->bb = apr_brigade_create(f->r->pool, f->r->connection->bucket_alloc); fctx->cfg = cfg; @@ -518,7 +524,7 @@ index 4205a61..27614fe 100644 apr_table_unset(f->r->headers_out, "Content-Length"); if (cfg->interp) -@@ -1028,7 +1001,7 @@ static void *proxy_html_config(apr_pool_t *pool, char *x) +@@ -1028,7 +1000,7 @@ static void *proxy_html_config(apr_pool_t *pool, char *x) proxy_html_conf *ret = apr_pcalloc(pool, sizeof(proxy_html_conf)); ret->doctype = DEFAULT_DOCTYPE; ret->etag = DEFAULT_ETAG; diff --git a/httpd.spec b/httpd.spec index d4f2cac..4da2794 100644 --- a/httpd.spec +++ b/httpd.spec @@ -25,7 +25,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.63 -Release: 13%{?dist}.4 +Release: 13%{?dist}.5 URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc @@ -886,6 +886,9 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Thu Jul 09 2026 Luboš Uhliarik - 2.4.63-13.5 +- Resolves: RHEL-192750 - mod_proxy_html regression in CVE-2026-34355 fix + * Tue Jun 23 2026 Luboš Uhliarik - 2.4.63-13.4 - Resolves: RHEL-186221 - httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356)