0bb1dcc715
via malicious backend servers (CVE-2026-34356) Resolves: RHEL-186190 - httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc (CVE-2026-42536) Resolves: RHEL-186181 - httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355) Resolves: RHEL-186160 - httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185) Resolves: RHEL-184308 - httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631) Resolves : RHEL-182579 - httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516) Resolves: RHEL-175622 - httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169) Resolves: RHEL-193112 - httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server (CVE-2026-44186) Resolves: RHEL-234657 - httpd: Apache HTTP Server: Privilege Escalation via .htaccess file manipulation (CVE-2026-24072) Resolves: RHEL-191241 - httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951) Also addresses CVE-2026-44119, CVE-2026-42535, CVE-2026-33006
81 lines
3.4 KiB
Diff
81 lines
3.4 KiB
Diff
diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
|
|
index 93430e5..c718f6f 100644
|
|
--- a/modules/mappers/mod_rewrite.c
|
|
+++ b/modules/mappers/mod_rewrite.c
|
|
@@ -3673,12 +3673,17 @@ static const char *cmd_rewritecond(cmd_parms *cmd, void *in_dconf,
|
|
newcond->regexp = regexp;
|
|
}
|
|
else if (newcond->ptype == CONDPAT_AP_EXPR) {
|
|
+ int in_htaccess = cmd->pool == cmd->temp_pool;
|
|
unsigned int flags = newcond->flags & CONDFLAG_NOVARY ?
|
|
AP_EXPR_FLAG_DONT_VARY : 0;
|
|
+ /* Use restricted ap_expr() parser in htaccess context. */
|
|
+ if (in_htaccess) flags |= AP_EXPR_FLAG_RESTRICTED;
|
|
newcond->expr = ap_expr_parse_cmd(cmd, a2, flags, &err, NULL);
|
|
if (err)
|
|
return apr_psprintf(cmd->pool, "RewriteCond: cannot compile "
|
|
- "expression \"%s\": %s", a2, err);
|
|
+ "expression%s \"%s\" %s",
|
|
+ in_htaccess ? " in htaccess context" : "",
|
|
+ a2, err);
|
|
}
|
|
|
|
return NULL;
|
|
diff --git a/modules/metadata/mod_setenvif.c b/modules/metadata/mod_setenvif.c
|
|
index 23d60cd..b74c9c0 100644
|
|
--- a/modules/metadata/mod_setenvif.c
|
|
+++ b/modules/metadata/mod_setenvif.c
|
|
@@ -422,6 +422,12 @@ static const char *add_setenvifexpr(cmd_parms *cmd, void *mconfig,
|
|
sei_cfg_rec *sconf;
|
|
sei_entry *new;
|
|
const char *err;
|
|
+ unsigned int flags = 0;
|
|
+
|
|
+ /* Use restricted ap_expr() parser in htaccess context. */
|
|
+ if (cmd->pool == cmd->temp_pool) {
|
|
+ flags |= AP_EXPR_FLAG_RESTRICTED;
|
|
+ }
|
|
|
|
/*
|
|
* Determine from our context into which record to put the entry.
|
|
@@ -445,7 +451,7 @@ static const char *add_setenvifexpr(cmd_parms *cmd, void *mconfig,
|
|
new->regex = NULL;
|
|
new->pattern = NULL;
|
|
new->preg = NULL;
|
|
- new->expr = ap_expr_parse_cmd(cmd, expr, 0, &err, NULL);
|
|
+ new->expr = ap_expr_parse_cmd(cmd, expr, flags, &err, NULL);
|
|
if (err)
|
|
return apr_psprintf(cmd->pool, "Could not parse expression \"%s\": %s",
|
|
expr, err);
|
|
diff --git a/modules/proxy/mod_proxy_fcgi.c b/modules/proxy/mod_proxy_fcgi.c
|
|
index 128cf1e..ef090dd 100644
|
|
--- a/modules/proxy/mod_proxy_fcgi.c
|
|
+++ b/modules/proxy/mod_proxy_fcgi.c
|
|
@@ -1338,9 +1338,15 @@ static const char *cmd_setenv(cmd_parms *cmd, void *in_dconf,
|
|
const char *err;
|
|
sei_entry *new;
|
|
const char *envvar = arg2;
|
|
+ unsigned int flags = 0;
|
|
+
|
|
+ /* Use restricted ap_expr() parser in htaccess context. */
|
|
+ if (cmd->pool == cmd->temp_pool) {
|
|
+ flags |= AP_EXPR_FLAG_RESTRICTED;
|
|
+ }
|
|
|
|
new = apr_array_push(dconf->env_fixups);
|
|
- new->cond = ap_expr_parse_cmd(cmd, arg1, 0, &err, NULL);
|
|
+ new->cond = ap_expr_parse_cmd(cmd, arg1, flags, &err, NULL);
|
|
if (err) {
|
|
return apr_psprintf(cmd->pool, "Could not parse expression \"%s\": %s",
|
|
arg1, err);
|
|
@@ -1367,7 +1373,8 @@ static const char *cmd_setenv(cmd_parms *cmd, void *in_dconf,
|
|
arg3 = "";
|
|
}
|
|
|
|
- new->subst = ap_expr_parse_cmd(cmd, arg3, AP_EXPR_FLAG_STRING_RESULT, &err, NULL);
|
|
+ flags |= AP_EXPR_FLAG_STRING_RESULT;
|
|
+ new->subst = ap_expr_parse_cmd(cmd, arg3, flags, &err, NULL);
|
|
if (err) {
|
|
return apr_psprintf(cmd->pool, "Could not parse expression \"%s\": %s",
|
|
arg3, err);
|