rpms/httpd
6
0
Fork 0
Code Issues Pull Requests Releases Activity

import httpd-2.4.37-47.module+el8.6.0+15654+427eba2e.2

Browse Source
This commit is contained in:
CentOS Sources 2022-06-22 05:24:53 -04:00 committed by Stepan Oksanichenko
parent f49445b5d8
commit eeec984029
2 changed files with 20 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
SOURCES/httpd-2.4.37-CVE-2020-13950.patch Normal file
View File

@ -0,0 +1,12 @@
diff --git a/modules/proxy/mod_proxy_http.c b/modules/proxy/mod_proxy_http.c
index 5786ea8..7da9bde 100644
--- a/modules/proxy/mod_proxy_http.c
+++ b/modules/proxy/mod_proxy_http.c
@@ -637,7 +637,6 @@ static int ap_proxy_http_prefetch(proxy_http_req_t *req,
"chunked body with Content-Length (C-L ignored)",
c->client_ip, c->remote_host ? c->remote_host: "");
req->old_cl_val = NULL;
- origin->keepalive = AP_CONN_CLOSE;
p_conn->close = 1;
}

9
SPECS/httpd.spec
View File

@ -13,7 +13,7 @@
Summary: Apache HTTP Server Summary: Apache HTTP Server
Name: httpd Name: httpd
Version: 2.4.37 Version: 2.4.37
Release: 47%{?dist}.1 Release: 47%{?dist}.2
URL: https://httpd.apache.org/ URL: https://httpd.apache.org/
Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
Source2: httpd.logrotate Source2: httpd.logrotate
@ -216,6 +216,8 @@ Patch221: httpd-2.4.37-CVE-2021-44790.patch
Patch222: httpd-2.4.37-CVE-2021-44224.patch Patch222: httpd-2.4.37-CVE-2021-44224.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=2064321 # https://bugzilla.redhat.com/show_bug.cgi?id=2064321
Patch223: httpd-2.4.37-CVE-2022-22720.patch Patch223: httpd-2.4.37-CVE-2022-22720.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=1966738
Patch224: httpd-2.4.37-CVE-2020-13950.patch
License: ASL 2.0 License: ASL 2.0
Group: System Environment/Daemons Group: System Environment/Daemons
@ -421,6 +423,7 @@ interface for storing and accessing per-user session data.
%patch221 -p1 -b .CVE-2021-44790 %patch221 -p1 -b .CVE-2021-44790
%patch222 -p1 -b .CVE-2021-44224 %patch222 -p1 -b .CVE-2021-44224
%patch223 -p1 -b .CVE-2022-22720 %patch223 -p1 -b .CVE-2022-22720
%patch224 -p1 -b .CVE-2020-13950
# Patch in the vendor string # Patch in the vendor string
sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@ -926,6 +929,10 @@ rm -rf $RPM_BUILD_ROOT
%{_rpmconfigdir}/macros.d/macros.httpd %{_rpmconfigdir}/macros.d/macros.httpd
%changelog %changelog
* Wed Jun 15 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-47.2
- Resolves: #2097247 - CVE-2020-13950 httpd:2.4/httpd: mod_proxy NULL pointer
dereference
* Mon Mar 21 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-47.1 * Mon Mar 21 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-47.1
- Resolves: #2065248 - CVE-2022-22720 httpd:2.4/httpd: HTTP request smuggling - Resolves: #2065248 - CVE-2022-22720 httpd:2.4/httpd: HTTP request smuggling
vulnerability in Apache HTTP Server 2.4.52 and earlier vulnerability in Apache HTTP Server 2.4.52 and earlier