.do-not-sync-with-fedora

@@ -0,0 +1,3 @@
+Owner: luhliari
+Rationale: RHEL branding is used in this package, will be merged manually
+           with Fedora as required.

.fmf/version

@@ -0,0 +1 @@
+1

.gitignore

@@ -1,2 +1,5 @@
-SOURCES/apache-poweredby.png
-SOURCES/httpd-2.4.37.tar.bz2
+/httpd-2.4.28.tar.bz2
+/httpd-2.4.33.tar.bz2
+/httpd-2.4.35.tar.bz2
+/httpd-2.4.37.tar.bz2
+/httpd.conf.5

.httpd.metadata

@@ -1,2 +1 @@
-3a7449d6cff00e5ccb3ed8571f34c0528555d38f SOURCES/apache-poweredby.png
-4a38471de821288b0300148016f2b03dfee8adf2 SOURCES/httpd-2.4.37.tar.bz2
+4a38471de821288b0300148016f2b03dfee8adf2 httpd-2.4.37.tar.bz2

01-md.conf

@@ -0,0 +1 @@
+LoadModule md_module modules/mod_md.so

httpd-2.4.37-CVE-2023-38709.patch

@@ -0,0 +1,74 @@
+diff --git a/modules/http/http_filters.c b/modules/http/http_filters.c
+index 393343a..16cb23c 100644
+--- a/modules/http/http_filters.c
++++ b/modules/http/http_filters.c
+@@ -1348,6 +1348,9 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f,
+          */
+         apr_table_clear(r->headers_out);
+         apr_table_clear(r->err_headers_out);
++        r->content_type = r->content_encoding = NULL;
++        r->content_languages = NULL;
++        r->clength = r->chunked = 0;
+         apr_brigade_cleanup(b);
+ 
+         /* Don't recall ap_die() if we come back here (from its own internal
+@@ -1364,8 +1367,6 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f,
+         APR_BRIGADE_INSERT_TAIL(b, e);
+         e = apr_bucket_eos_create(c->bucket_alloc);
+         APR_BRIGADE_INSERT_TAIL(b, e);
+-        r->content_type = r->content_encoding = NULL;
+-        r->content_languages = NULL;
+         ap_set_content_length(r, 0);
+         recursive_error = 1;
+     }
+@@ -1392,6 +1393,7 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f,
+     if (!apr_is_empty_table(r->err_headers_out)) {
+         r->headers_out = apr_table_overlay(r->pool, r->err_headers_out,
+                                            r->headers_out);
++        apr_table_clear(r->err_headers_out);
+     }
+ 
+     /*
+@@ -1411,6 +1413,17 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f,
+         fixup_vary(r);
+     }
+ 
++
++    /*
++     * Control cachability for non-cacheable responses if not already set by
++     * some other part of the server configuration.
++     */
++    if (r->no_cache && !apr_table_get(r->headers_out, "Expires")) {
++        char *date = apr_palloc(r->pool, APR_RFC822_DATE_LEN);
++        ap_recent_rfc822_date(date, r->request_time);
++        apr_table_addn(r->headers_out, "Expires", date);
++    }
++
+     /*
+      * Now remove any ETag response header field if earlier processing
+      * says so (such as a 'FileETag None' directive).
+@@ -1423,6 +1436,7 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f,
+     basic_http_header_check(r, &protocol);
+     ap_set_keepalive(r);
+ 
++    /* 204/304 responses don't have content related headers */
+     if (AP_STATUS_IS_HEADER_ONLY(r->status)) {
+         apr_table_unset(r->headers_out, "Transfer-Encoding");
+         apr_table_unset(r->headers_out, "Content-Length");
+@@ -1465,16 +1479,6 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f,
+         apr_table_setn(r->headers_out, "Content-Language", field);
+     }
+ 
+-    /*
+-     * Control cachability for non-cacheable responses if not already set by
+-     * some other part of the server configuration.
+-     */
+-    if (r->no_cache && !apr_table_get(r->headers_out, "Expires")) {
+-        char *date = apr_palloc(r->pool, APR_RFC822_DATE_LEN);
+-        ap_recent_rfc822_date(date, r->request_time);
+-        apr_table_addn(r->headers_out, "Expires", date);
+-    }
+-
+     /* This is a hack, but I can't find anyway around it.  The idea is that
+      * we don't want to send out 0 Content-Lengths if it is a head request.
+      * This happens when modules try to outsmart the server, and return