dac09acc90
Resolves: RHEL-186226 - httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356) Resolves: RHEL-182580 - httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516) Resolves: RHEL-186187 - httpd: mod_proxy_html buffer handling vulnerability (CVE-2026-34355) Resolves: RHEL-175632 - httpd: mod_dav_lock uses wrong lock discovery (CVE-2026-29169) Resolves: RHEL-186189 - mod_xml2enc: fix bblen accounting in fix_skipto (CVE-2026-42536) Resolves: RHEL-186156 - httpd: fix OCSP write buffer advancement bug in mod_ssl (CVE-2026-44185) Resolves: RHEL-191249 - httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951) Resolves: RHEL-193128 - httpd: Apache HTTP Server: Denial of Service in mod_proxy_ftp via attacker-controlled FTP server (CVE-2026-44186) Also addresses CVE-2026-24072, CVE-2026-33006, CVE-2026-42535, CVE-2026-44119
19 lines
709 B
Diff
19 lines
709 B
Diff
diff --git a/modules/proxy/mod_proxy_ftp.c b/modules/proxy/mod_proxy_ftp.c
|
|
index 5175e45..5b97c3d 100644
|
|
--- a/modules/proxy/mod_proxy_ftp.c
|
|
+++ b/modules/proxy/mod_proxy_ftp.c
|
|
@@ -1204,10 +1204,12 @@ static int proxy_ftp_handler(request_rec *r, proxy_worker *worker,
|
|
time_t secs;
|
|
|
|
/* Look for a number, preceded by whitespace */
|
|
- while (*secs_str)
|
|
+ while (*secs_str) {
|
|
if ((secs_str==ftpmessage || apr_isspace(secs_str[-1])) &&
|
|
apr_isdigit(secs_str[0]))
|
|
break;
|
|
+ secs_str++;
|
|
+ }
|
|
if (*secs_str != '\0') {
|
|
secs = atol(secs_str);
|
|
apr_table_addn(r->headers_out, "Retry-After",
|