dac09acc90
Resolves: RHEL-186226 - httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356) Resolves: RHEL-182580 - httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516) Resolves: RHEL-186187 - httpd: mod_proxy_html buffer handling vulnerability (CVE-2026-34355) Resolves: RHEL-175632 - httpd: mod_dav_lock uses wrong lock discovery (CVE-2026-29169) Resolves: RHEL-186189 - mod_xml2enc: fix bblen accounting in fix_skipto (CVE-2026-42536) Resolves: RHEL-186156 - httpd: fix OCSP write buffer advancement bug in mod_ssl (CVE-2026-44185) Resolves: RHEL-191249 - httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951) Resolves: RHEL-193128 - httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server (CVE-2026-44186) Also addresses CVE-2026-24072, CVE-2026-33006, CVE-2026-42535, CVE-2026-44119
31 lines
1.3 KiB
Diff
31 lines
1.3 KiB
Diff
diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c
|
|
index 00fedb1..81b7de2 100644
|
|
--- a/modules/proxy/proxy_util.c
|
|
+++ b/modules/proxy/proxy_util.c
|
|
@@ -1036,6 +1036,12 @@ PROXY_DECLARE(const char *) ap_proxy_cookie_reverse_map(request_rec *r,
|
|
poffs = pathp - tmpstr_orig;
|
|
l1 = strlen(pathp);
|
|
pathe = str + poffs + l1;
|
|
+ /*
|
|
+ * RFC 6265 § 5.3 7): Only the last path= should be meaningful
|
|
+ * so reset anything previously found.
|
|
+ */
|
|
+ newpath = NULL;
|
|
+ pdiff = 0;
|
|
if (conf->interpolate_env == 1) {
|
|
ent = (struct proxy_alias *)rconf->cookie_paths->elts;
|
|
}
|
|
@@ -1056,6 +1062,12 @@ PROXY_DECLARE(const char *) ap_proxy_cookie_reverse_map(request_rec *r,
|
|
doffs = domainp - tmpstr_orig;
|
|
l1 = strlen(domainp);
|
|
domaine = str + doffs + l1;
|
|
+ /*
|
|
+ * RFC 6265 § 5.3 4): Only the last domain= should be meaningful
|
|
+ * so reset anything previously found.
|
|
+ */
|
|
+ newdomain = NULL;
|
|
+ ddiff = 0;
|
|
if (conf->interpolate_env == 1) {
|
|
ent = (struct proxy_alias *)rconf->cookie_domains->elts;
|
|
}
|