rpms/httpd
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Resolves: RHEL-190817 - httpd: Apache HTTP Server: Arbitrary code

Browse Source 
execution or denial of service via use-after-free in mod_ldap per-directory
  configuration (CVE-2026-29167)
This commit is contained in:
Luboš Uhliarik 2026-08-25 11:37:25 +02:00
parent 7ea902ca62
commit f36e7ae91d
2 changed files with 57 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
httpd-2.4.37-CVE-2026-29167.patch Normal file
View File

@ -0,0 +1,48 @@
From 1dc6b58fbaee6401d110c616ac45088cbd119123 Mon Sep 17 00:00:00 2001
From: Joe Orton <jorton@apache.org>
Date: Wed, 3 Jun 2026 17:09:40 +0000
Subject: [PATCH] Merge r1934932 from trunk:
* modules/ldap/util_ldap.c (uldap_connection_find): Fix inheritance in
per-dir context.
Reviewed by: jorton, covener, jfclere
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1934935 13f79535-47bb-0310-9956-ffa450edef68
---
modules/ldap/util_ldap.c | 19 +++++++++++++++++--
1 file changed, 17 insertions(+), 2 deletions(-)
diff --git a/modules/ldap/util_ldap.c b/modules/ldap/util_ldap.c
index b71dc98..7cf981d 100644
--- a/modules/ldap/util_ldap.c
+++ b/modules/ldap/util_ldap.c
@@ -882,8 +882,23 @@ static util_ldap_connection_t *
*/
l->secure = secureflag;
- /* save away a copy of the client cert list that is presently valid */
- l->client_certs = apr_array_copy_hdr(l->pool, dc->client_certs);
+ /* Deep-copy the client cert list into the connection pool so that
+ * the cached connection does not retain pointers into the
+ * (potentially short-lived) per-directory config pool.
+ */
+ l->client_certs = apr_array_copy(l->pool, dc->client_certs);
+ if (!apr_is_empty_array(l->client_certs)) {
+ int i;
+ apr_ldap_opt_tls_cert_t *certs;
+
+ certs = (apr_ldap_opt_tls_cert_t *)l->client_certs->elts;
+ for (i = 0; i < l->client_certs->nelts; i++) {
+ if (certs[i].path)
+ certs[i].path = apr_pstrdup(l->pool, certs[i].path);
+ if (certs[i].password)
+ certs[i].password = apr_pstrdup(l->pool, certs[i].password);
+ }
+ }
/* whether or not to keep this connection in the pool when it's returned */
l->keep = (st->connection_pool_ttl == 0) ? 0 : 1;
--
2.44.0

10
httpd.spec
View File

@ -14,7 +14,7 @@
Summary: Apache HTTP Server
Name: httpd
Version: 2.4.37
Release: 65%{?dist}.9
Release: 65%{?dist}.10
URL: https://httpd.apache.org/
Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
Source2: httpd.logrotate
@ -327,6 +327,8 @@ Patch266: httpd-2.4.37-CVE-2026-43951.patch
Patch267: httpd-2.4.37-CVE-2026-44631.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=2374549
Patch268: httpd-2.4.37-CVE-2024-42516.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=2486394
Patch269: httpd-2.4.37-CVE-2026-29167.patch
License: ASL 2.0
Group: System Environment/Daemons
@ -585,6 +587,7 @@ interface for storing and accessing per-user session data.
%patch266 -p1 -b .CVE-2026-43951
%patch267 -p1 -b .CVE-2026-44631
%patch268 -p1 -b .CVE-2024-42516
%patch269 -p1 -b .CVE-2026-29167
%patch96 -p1 -b .r1922080
@ -1096,6 +1099,11 @@ rm -rf $RPM_BUILD_ROOT
%{_rpmconfigdir}/macros.d/macros.httpd
%changelog
* Tue Aug 25 2026 Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-65.10
- Resolves: RHEL-190817 - httpd: Apache HTTP Server: Arbitrary code
execution or denial of service via use-after-free in mod_ldap per-directory
configuration (CVE-2026-29167)
* Thu Jul 09 2026 Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-65.9
- Resolves: RHEL-186198 - httpd: Apache HTTP Server: Heap-based Buffer Overflow
via untrusted content in mod_xml2enc (CVE-2026-42536)