dac09acc90
Resolves: RHEL-186226 - httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356) Resolves: RHEL-182580 - httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516) Resolves: RHEL-186187 - httpd: mod_proxy_html buffer handling vulnerability (CVE-2026-34355) Resolves: RHEL-175632 - httpd: mod_dav_lock uses wrong lock discovery (CVE-2026-29169) Resolves: RHEL-186189 - mod_xml2enc: fix bblen accounting in fix_skipto (CVE-2026-42536) Resolves: RHEL-186156 - httpd: fix OCSP write buffer advancement bug in mod_ssl (CVE-2026-44185) Resolves: RHEL-191249 - httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951) Resolves: RHEL-193128 - httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server (CVE-2026-44186) Also addresses CVE-2026-24072, CVE-2026-33006, CVE-2026-42535, CVE-2026-44119
81 lines
3.4 KiB
Diff
81 lines
3.4 KiB
Diff
diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
|
|
index f735c50..28c929d 100644
|
|
--- a/modules/mappers/mod_rewrite.c
|
|
+++ b/modules/mappers/mod_rewrite.c
|
|
@@ -3639,12 +3639,17 @@ static const char *cmd_rewritecond(cmd_parms *cmd, void *in_dconf,
|
|
newcond->regexp = regexp;
|
|
}
|
|
else if (newcond->ptype == CONDPAT_AP_EXPR) {
|
|
+ int in_htaccess = cmd->pool == cmd->temp_pool;
|
|
unsigned int flags = newcond->flags & CONDFLAG_NOVARY ?
|
|
AP_EXPR_FLAG_DONT_VARY : 0;
|
|
+ /* Use restricted ap_expr() parser in htaccess context. */
|
|
+ if (in_htaccess) flags |= AP_EXPR_FLAG_RESTRICTED;
|
|
newcond->expr = ap_expr_parse_cmd(cmd, a2, flags, &err, NULL);
|
|
if (err)
|
|
return apr_psprintf(cmd->pool, "RewriteCond: cannot compile "
|
|
- "expression \"%s\": %s", a2, err);
|
|
+ "expression%s \"%s\" %s",
|
|
+ in_htaccess ? " in htaccess context" : "",
|
|
+ a2, err);
|
|
}
|
|
|
|
return NULL;
|
|
diff --git a/modules/metadata/mod_setenvif.c b/modules/metadata/mod_setenvif.c
|
|
index 23d60cd..b74c9c0 100644
|
|
--- a/modules/metadata/mod_setenvif.c
|
|
+++ b/modules/metadata/mod_setenvif.c
|
|
@@ -422,6 +422,12 @@ static const char *add_setenvifexpr(cmd_parms *cmd, void *mconfig,
|
|
sei_cfg_rec *sconf;
|
|
sei_entry *new;
|
|
const char *err;
|
|
+ unsigned int flags = 0;
|
|
+
|
|
+ /* Use restricted ap_expr() parser in htaccess context. */
|
|
+ if (cmd->pool == cmd->temp_pool) {
|
|
+ flags |= AP_EXPR_FLAG_RESTRICTED;
|
|
+ }
|
|
|
|
/*
|
|
* Determine from our context into which record to put the entry.
|
|
@@ -445,7 +451,7 @@ static const char *add_setenvifexpr(cmd_parms *cmd, void *mconfig,
|
|
new->regex = NULL;
|
|
new->pattern = NULL;
|
|
new->preg = NULL;
|
|
- new->expr = ap_expr_parse_cmd(cmd, expr, 0, &err, NULL);
|
|
+ new->expr = ap_expr_parse_cmd(cmd, expr, flags, &err, NULL);
|
|
if (err)
|
|
return apr_psprintf(cmd->pool, "Could not parse expression \"%s\": %s",
|
|
expr, err);
|
|
diff --git a/modules/proxy/mod_proxy_fcgi.c b/modules/proxy/mod_proxy_fcgi.c
|
|
index 50f443e..b0156a9 100644
|
|
--- a/modules/proxy/mod_proxy_fcgi.c
|
|
+++ b/modules/proxy/mod_proxy_fcgi.c
|
|
@@ -1302,9 +1302,15 @@ static const char *cmd_setenv(cmd_parms *cmd, void *in_dconf,
|
|
const char *err;
|
|
sei_entry *new;
|
|
const char *envvar = arg2;
|
|
+ unsigned int flags = 0;
|
|
+
|
|
+ /* Use restricted ap_expr() parser in htaccess context. */
|
|
+ if (cmd->pool == cmd->temp_pool) {
|
|
+ flags |= AP_EXPR_FLAG_RESTRICTED;
|
|
+ }
|
|
|
|
new = apr_array_push(dconf->env_fixups);
|
|
- new->cond = ap_expr_parse_cmd(cmd, arg1, 0, &err, NULL);
|
|
+ new->cond = ap_expr_parse_cmd(cmd, arg1, flags, &err, NULL);
|
|
if (err) {
|
|
return apr_psprintf(cmd->pool, "Could not parse expression \"%s\": %s",
|
|
arg1, err);
|
|
@@ -1331,7 +1337,8 @@ static const char *cmd_setenv(cmd_parms *cmd, void *in_dconf,
|
|
arg3 = "";
|
|
}
|
|
|
|
- new->subst = ap_expr_parse_cmd(cmd, arg3, AP_EXPR_FLAG_STRING_RESULT, &err, NULL);
|
|
+ flags |= AP_EXPR_FLAG_STRING_RESULT;
|
|
+ new->subst = ap_expr_parse_cmd(cmd, arg3, flags, &err, NULL);
|
|
if (err) {
|
|
return apr_psprintf(cmd->pool, "Could not parse expression \"%s\": %s",
|
|
arg3, err);
|