From f36e7ae91df6c50f9fe2de92816435f8652de669 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= Date: Tue, 25 Aug 2026 11:37:25 +0200 Subject: [PATCH] Resolves: RHEL-190817 - httpd: Apache HTTP Server: Arbitrary code execution or denial of service via use-after-free in mod_ldap per-directory configuration (CVE-2026-29167) --- httpd-2.4.37-CVE-2026-29167.patch | 48 +++++++++++++++++++++++++++++++ httpd.spec | 10 ++++++- 2 files changed, 57 insertions(+), 1 deletion(-) create mode 100644 httpd-2.4.37-CVE-2026-29167.patch diff --git a/httpd-2.4.37-CVE-2026-29167.patch b/httpd-2.4.37-CVE-2026-29167.patch new file mode 100644 index 0000000..dc884ce --- /dev/null +++ b/httpd-2.4.37-CVE-2026-29167.patch @@ -0,0 +1,48 @@ +From 1dc6b58fbaee6401d110c616ac45088cbd119123 Mon Sep 17 00:00:00 2001 +From: Joe Orton +Date: Wed, 3 Jun 2026 17:09:40 +0000 +Subject: [PATCH] Merge r1934932 from trunk: + +* modules/ldap/util_ldap.c (uldap_connection_find): Fix inheritance in + per-dir context. + +Reviewed by: jorton, covener, jfclere + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1934935 13f79535-47bb-0310-9956-ffa450edef68 +--- + modules/ldap/util_ldap.c | 19 +++++++++++++++++-- + 1 file changed, 17 insertions(+), 2 deletions(-) + +diff --git a/modules/ldap/util_ldap.c b/modules/ldap/util_ldap.c +index b71dc98..7cf981d 100644 +--- a/modules/ldap/util_ldap.c ++++ b/modules/ldap/util_ldap.c +@@ -882,8 +882,23 @@ static util_ldap_connection_t * + */ + l->secure = secureflag; + +- /* save away a copy of the client cert list that is presently valid */ +- l->client_certs = apr_array_copy_hdr(l->pool, dc->client_certs); ++ /* Deep-copy the client cert list into the connection pool so that ++ * the cached connection does not retain pointers into the ++ * (potentially short-lived) per-directory config pool. ++ */ ++ l->client_certs = apr_array_copy(l->pool, dc->client_certs); ++ if (!apr_is_empty_array(l->client_certs)) { ++ int i; ++ apr_ldap_opt_tls_cert_t *certs; ++ ++ certs = (apr_ldap_opt_tls_cert_t *)l->client_certs->elts; ++ for (i = 0; i < l->client_certs->nelts; i++) { ++ if (certs[i].path) ++ certs[i].path = apr_pstrdup(l->pool, certs[i].path); ++ if (certs[i].password) ++ certs[i].password = apr_pstrdup(l->pool, certs[i].password); ++ } ++ } + + /* whether or not to keep this connection in the pool when it's returned */ + l->keep = (st->connection_pool_ttl == 0) ? 0 : 1; +-- +2.44.0 + diff --git a/httpd.spec b/httpd.spec index 954a97d..8f66603 100644 --- a/httpd.spec +++ b/httpd.spec @@ -14,7 +14,7 @@ Summary: Apache HTTP Server Name: httpd Version: 2.4.37 -Release: 65%{?dist}.9 +Release: 65%{?dist}.10 URL: https://httpd.apache.org/ Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2 Source2: httpd.logrotate @@ -327,6 +327,8 @@ Patch266: httpd-2.4.37-CVE-2026-43951.patch Patch267: httpd-2.4.37-CVE-2026-44631.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2374549 Patch268: httpd-2.4.37-CVE-2024-42516.patch +# https://bugzilla.redhat.com/show_bug.cgi?id=2486394 +Patch269: httpd-2.4.37-CVE-2026-29167.patch License: ASL 2.0 Group: System Environment/Daemons @@ -585,6 +587,7 @@ interface for storing and accessing per-user session data. %patch266 -p1 -b .CVE-2026-43951 %patch267 -p1 -b .CVE-2026-44631 %patch268 -p1 -b .CVE-2024-42516 +%patch269 -p1 -b .CVE-2026-29167 %patch96 -p1 -b .r1922080 @@ -1096,6 +1099,11 @@ rm -rf $RPM_BUILD_ROOT %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Tue Aug 25 2026 Luboš Uhliarik - 2.4.37-65.10 +- Resolves: RHEL-190817 - httpd: Apache HTTP Server: Arbitrary code + execution or denial of service via use-after-free in mod_ldap per-directory + configuration (CVE-2026-29167) + * Thu Jul 09 2026 Luboš Uhliarik - 2.4.37-65.9 - Resolves: RHEL-186198 - httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc (CVE-2026-42536)