dac09acc90
Resolves: RHEL-186226 - httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356) Resolves: RHEL-182580 - httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516) Resolves: RHEL-186187 - httpd: mod_proxy_html buffer handling vulnerability (CVE-2026-34355) Resolves: RHEL-175632 - httpd: mod_dav_lock uses wrong lock discovery (CVE-2026-29169) Resolves: RHEL-186189 - mod_xml2enc: fix bblen accounting in fix_skipto (CVE-2026-42536) Resolves: RHEL-186156 - httpd: fix OCSP write buffer advancement bug in mod_ssl (CVE-2026-44185) Resolves: RHEL-191249 - httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951) Resolves: RHEL-193128 - httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server (CVE-2026-44186) Also addresses CVE-2026-24072, CVE-2026-33006, CVE-2026-42535, CVE-2026-44119
55 lines
1.8 KiB
Diff
55 lines
1.8 KiB
Diff
diff --git a/modules/dav/fs/repos.c b/modules/dav/fs/repos.c
|
|
index 64bc894..fbab779 100644
|
|
--- a/modules/dav/fs/repos.c
|
|
+++ b/modules/dav/fs/repos.c
|
|
@@ -22,6 +22,7 @@
|
|
#include "apr_file_io.h"
|
|
#include "apr_strings.h"
|
|
#include "apr_buckets.h"
|
|
+#include "apr_lib.h"
|
|
|
|
#if APR_HAVE_UNISTD_H
|
|
#include <unistd.h> /* for getpid() */
|
|
@@ -673,8 +674,8 @@ static dav_error * dav_fs_get_resource(
|
|
{
|
|
dav_resource_private *ctx;
|
|
dav_resource *resource;
|
|
- char *s;
|
|
- char *filename;
|
|
+ char *s, *parent;
|
|
+ const char *filename, *dirname;
|
|
apr_size_t len;
|
|
|
|
/* ### optimize this into a single allocation! */
|
|
@@ -708,6 +709,30 @@ static dav_error * dav_fs_get_resource(
|
|
if (len > 1 && s[len - 1] == '/') {
|
|
s[len - 1] = '\0';
|
|
}
|
|
+
|
|
+ /* Deny any access to, or within, the state directory. */
|
|
+ filename = apr_filepath_name_get(s);
|
|
+ parent = ap_make_dirstr_parent(r->pool, s);
|
|
+ /* Strip the trailing slash and extract the leaf directory name. */
|
|
+ len = strlen(parent);
|
|
+ if (len > 1 && parent[len - 1] == '/') {
|
|
+ parent[len - 1] = '\0';
|
|
+ }
|
|
+ dirname = apr_filepath_name_get(parent);
|
|
+#ifdef CASE_BLIND_FILESYSTEM
|
|
+ if (ap_cstr_casecmp(filename, DAV_FS_STATE_DIR) == 0
|
|
+ || ap_cstr_casecmp(dirname, DAV_FS_STATE_DIR) == 0) {
|
|
+#else
|
|
+ if (strcmp(filename, DAV_FS_STATE_DIR) == 0
|
|
+ || strcmp(dirname, DAV_FS_STATE_DIR) == 0) {
|
|
+#endif
|
|
+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
|
|
+ "access to " DAV_FS_STATE_DIR " state directory "
|
|
+ "denied for %s", r->filename);
|
|
+ return dav_new_error(r->pool, HTTP_FORBIDDEN, 0, 0,
|
|
+ "Access to the state directory denied.");
|
|
+ }
|
|
+
|
|
ctx->pathname = s;
|
|
|
|
/* Create resource descriptor */
|