diff -Nru apache2-2.4.52/debian/changelog apache2-2.4.52/debian/changelog --- apache2-2.4.52/debian/changelog 2023-10-26 13:44:44.000000000 +0000 +++ apache2-2.4.52/debian/changelog 2024-04-10 17:45:18.000000000 +0000 @@ -1,3 +1,35 @@ +apache2 (2.4.52-1ubuntu4.9) jammy-security; urgency=medium + + * SECURITY UPDATE: HTTP response splitting + - debian/patches/CVE-2023-38709.patch: header validation after + content-* are eval'ed in modules/http/http_filters.c. + - CVE-2023-38709 + * SECURITY UPDATE: HTTP Response Splitting in multiple modules + - debian/patches/CVE-2024-24795.patch: let httpd handle CL/TE for + non-http handlers in include/util_script.h, + modules/aaa/mod_authnz_fcgi.c, modules/generators/mod_cgi.c, + modules/generators/mod_cgid.c, modules/http/http_filters.c, + modules/proxy/ajp_header.c, modules/proxy/mod_proxy_fcgi.c, + modules/proxy/mod_proxy_scgi.c, modules/proxy/mod_proxy_uwsgi.c. + - CVE-2024-24795 + * SECURITY UPDATE: HTTP/2 DoS by memory exhaustion on endless + continuation frames + - debian/patches/CVE-2024-27316.patch: bail after too many failed reads + in modules/http2/h2_session.c, modules/http2/h2_stream.c, + modules/http2/h2_stream.h. + - CVE-2024-27316 + + -- Marc Deslauriers Wed, 10 Apr 2024 13:45:18 -0400 + +apache2 (2.4.52-1ubuntu4.8) jammy; urgency=medium + + * d/c/m/setenvif.conf, d/p/fix-dolphin-to-delete-webdav-dirs.patch: Add + dolphin and Konqueror/5 careful redirection so that directories can be + deleted via webdav. + (LP: #1927742) + + -- Bryce Harrington Tue, 16 Jan 2024 19:00:18 -0800 + apache2 (2.4.52-1ubuntu4.7) jammy-security; urgency=medium * SECURITY UPDATE: mod_macro buffer over-read diff -Nru apache2-2.4.52/debian/config-dir/mods-available/setenvif.conf apache2-2.4.52/debian/config-dir/mods-available/setenvif.conf --- apache2-2.4.52/debian/config-dir/mods-available/setenvif.conf 2023-05-03 20:02:51.000000000 +0000 +++ apache2-2.4.52/debian/config-dir/mods-available/setenvif.conf 2024-01-17 03:00:18.000000000 +0000 @@ -26,6 +26,8 @@ BrowserMatch "^XML Spy" redirect-carefully BrowserMatch "^Dreamweaver-WebDAV-SCM1" redirect-carefully BrowserMatch " Konqueror/4" redirect-carefully + BrowserMatch " Konqueror/5" redirect-carefully + BrowserMatch " dolphin/" redirect-carefully diff -Nru apache2-2.4.52/debian/patches/CVE-2023-38709.patch apache2-2.4.52/debian/patches/CVE-2023-38709.patch --- apache2-2.4.52/debian/patches/CVE-2023-38709.patch 1970-01-01 00:00:00.000000000 +0000 +++ apache2-2.4.52/debian/patches/CVE-2023-38709.patch 2024-04-10 17:44:47.000000000 +0000 @@ -0,0 +1,88 @@ +From ac20389f3c816d990aba21720f1492b69ac5cb44 Mon Sep 17 00:00:00 2001 +From: Eric Covener +Date: Wed, 3 Apr 2024 12:12:23 +0000 +Subject: [PATCH] header validation after content-* are eval'ed + +backport r1916770 from trunk +Submitted By: ylavic + + + + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1916778 13f79535-47bb-0310-9956-ffa450edef68 +--- + modules/http/http_filters.c | 28 ++++++++++++++++------------ + 1 file changed, 16 insertions(+), 12 deletions(-) + +--- a/modules/http/http_filters.c ++++ b/modules/http/http_filters.c +@@ -1353,6 +1353,9 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_ + */ + apr_table_clear(r->headers_out); + apr_table_clear(r->err_headers_out); ++ r->content_type = r->content_encoding = NULL; ++ r->content_languages = NULL; ++ r->clength = r->chunked = 0; + apr_brigade_cleanup(b); + + /* Don't recall ap_die() if we come back here (from its own internal +@@ -1369,8 +1372,6 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_ + APR_BRIGADE_INSERT_TAIL(b, e); + e = apr_bucket_eos_create(c->bucket_alloc); + APR_BRIGADE_INSERT_TAIL(b, e); +- r->content_type = r->content_encoding = NULL; +- r->content_languages = NULL; + ap_set_content_length(r, 0); + recursive_error = 1; + } +@@ -1397,6 +1398,7 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_ + if (!apr_is_empty_table(r->err_headers_out)) { + r->headers_out = apr_table_overlay(r->pool, r->err_headers_out, + r->headers_out); ++ apr_table_clear(r->err_headers_out); + } + + /* +@@ -1416,6 +1418,17 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_ + fixup_vary(r); + } + ++ ++ /* ++ * Control cachability for non-cacheable responses if not already set by ++ * some other part of the server configuration. ++ */ ++ if (r->no_cache && !apr_table_get(r->headers_out, "Expires")) { ++ char *date = apr_palloc(r->pool, APR_RFC822_DATE_LEN); ++ ap_recent_rfc822_date(date, r->request_time); ++ apr_table_addn(r->headers_out, "Expires", date); ++ } ++ + /* + * Now remove any ETag response header field if earlier processing + * says so (such as a 'FileETag None' directive). +@@ -1428,6 +1441,7 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_ + basic_http_header_check(r, &protocol); + ap_set_keepalive(r); + ++ /* 204/304 responses don't have content related headers */ + if (AP_STATUS_IS_HEADER_ONLY(r->status)) { + apr_table_unset(r->headers_out, "Transfer-Encoding"); + apr_table_unset(r->headers_out, "Content-Length"); +@@ -1470,16 +1484,6 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_ + apr_table_setn(r->headers_out, "Content-Language", field); + } + +- /* +- * Control cachability for non-cacheable responses if not already set by +- * some other part of the server configuration. +- */ +- if (r->no_cache && !apr_table_get(r->headers_out, "Expires")) { +- char *date = apr_palloc(r->pool, APR_RFC822_DATE_LEN); +- ap_recent_rfc822_date(date, r->request_time); +- apr_table_addn(r->headers_out, "Expires", date); +- } +- + /* This is a hack, but I can't find anyway around it. The idea is that + * we don't want to send out 0 Content-Lengths if it is a head request. + * This happens when modules try to outsmart the server, and return diff -Nru apache2-2.4.52/debian/patches/CVE-2024-24795.patch apache2-2.4.52/debian/patches/CVE-2024-24795.patch --- apache2-2.4.52/debian/patches/CVE-2024-24795.patch 1970-01-01 00:00:00.000000000 +0000 +++ apache2-2.4.52/debian/patches/CVE-2024-24795.patch 2024-04-10 17:44:57.000000000 +0000 @@ -0,0 +1,196 @@ +From a29723ce1af75eed0813c3717d3f6dee9b405ca8 Mon Sep 17 00:00:00 2001 +From: Eric Covener +Date: Wed, 3 Apr 2024 12:10:49 +0000 +Subject: [PATCH] let httpd handle CL/TE for non-http handlers + +backport r1916769 from trunk: +Submitted By: ylavic, covener + + + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1916777 13f79535-47bb-0310-9956-ffa450edef68 +--- + include/util_script.h | 2 ++ + modules/aaa/mod_authnz_fcgi.c | 8 ++++++++ + modules/generators/mod_cgi.c | 15 ++++++++++++--- + modules/generators/mod_cgid.c | 15 ++++++++++++--- + modules/http/http_filters.c | 12 ++++++++++++ + modules/proxy/ajp_header.c | 10 ++++++++++ + modules/proxy/mod_proxy_fcgi.c | 9 +++++++++ + modules/proxy/mod_proxy_scgi.c | 8 ++++++++ + modules/proxy/mod_proxy_uwsgi.c | 6 ++++++ + 9 files changed, 79 insertions(+), 6 deletions(-) + +--- a/include/util_script.h ++++ b/include/util_script.h +@@ -225,6 +225,8 @@ AP_DECLARE(int) ap_scan_script_header_er + */ + AP_DECLARE(void) ap_args_to_table(request_rec *r, apr_table_t **table); + ++#define AP_TRUST_CGILIKE_CL_ENVVAR "ap_trust_cgilike_cl" ++ + #ifdef __cplusplus + } + #endif +--- a/modules/aaa/mod_authnz_fcgi.c ++++ b/modules/aaa/mod_authnz_fcgi.c +@@ -571,6 +571,14 @@ static apr_status_t handle_response(cons + "parsing -> %d/%d", + fn, status, r->status); + ++ /* FCGI has its own body framing mechanism which we don't ++ * match against any provided Content-Length, so let the ++ * core determine C-L vs T-E based on what's actually sent. ++ */ ++ if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR)) ++ apr_table_unset(r->headers_out, "Content-Length"); ++ apr_table_unset(r->headers_out, "Transfer-Encoding"); ++ + if (rspbuf) { /* caller wants to see response body, + * if any + */ +--- a/modules/generators/mod_cgi.c ++++ b/modules/generators/mod_cgi.c +@@ -935,9 +935,18 @@ static int cgi_handler(request_rec *r) + char sbuf[MAX_STRING_LEN]; + int ret; + +- if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf, +- APLOG_MODULE_INDEX))) +- { ++ ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf, ++ APLOG_MODULE_INDEX); ++ ++ /* xCGI has its own body framing mechanism which we don't ++ * match against any provided Content-Length, so let the ++ * core determine C-L vs T-E based on what's actually sent. ++ */ ++ if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR)) ++ apr_table_unset(r->headers_out, "Content-Length"); ++ apr_table_unset(r->headers_out, "Transfer-Encoding"); ++ ++ if (ret != OK) { + ret = log_script(r, conf, ret, dbuf, sbuf, bb, script_err); + + /* +--- a/modules/generators/mod_cgid.c ++++ b/modules/generators/mod_cgid.c +@@ -1616,9 +1616,18 @@ static int cgid_handler(request_rec *r) + b = apr_bucket_eos_create(c->bucket_alloc); + APR_BRIGADE_INSERT_TAIL(bb, b); + +- if ((ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf, +- APLOG_MODULE_INDEX))) +- { ++ ret = ap_scan_script_header_err_brigade_ex(r, bb, sbuf, ++ APLOG_MODULE_INDEX); ++ ++ /* xCGI has its own body framing mechanism which we don't ++ * match against any provided Content-Length, so let the ++ * core determine C-L vs T-E based on what's actually sent. ++ */ ++ if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR)) ++ apr_table_unset(r->headers_out, "Content-Length"); ++ apr_table_unset(r->headers_out, "Transfer-Encoding"); ++ ++ if (ret != OK) { + ret = log_script(r, conf, ret, dbuf, sbuf, bb, NULL); + + /* +--- a/modules/http/http_filters.c ++++ b/modules/http/http_filters.c +@@ -778,6 +778,18 @@ static APR_INLINE int check_headers(requ + struct check_header_ctx ctx; + core_server_config *conf = + ap_get_core_module_config(r->server->module_config); ++ const char *val; ++ ++ if ((val = apr_table_get(r->headers_out, "Transfer-Encoding"))) { ++ if (apr_table_get(r->headers_out, "Content-Length")) { ++ apr_table_unset(r->headers_out, "Content-Length"); ++ r->connection->keepalive = AP_CONN_CLOSE; ++ } ++ if (!ap_is_chunked(r->pool, val)) { ++ r->connection->keepalive = AP_CONN_CLOSE; ++ return 0; ++ } ++ } + + ctx.r = r; + ctx.strict = (conf->http_conformance != AP_HTTP_CONFORMANCE_UNSAFE); +--- a/modules/proxy/ajp_header.c ++++ b/modules/proxy/ajp_header.c +@@ -17,6 +17,8 @@ + #include "ajp_header.h" + #include "ajp.h" + ++#include "util_script.h" ++ + APLOG_USE_MODULE(proxy_ajp); + + static const char *response_trans_headers[] = { +@@ -662,6 +664,14 @@ static apr_status_t ajp_unmarshal_respon + } + } + ++ /* AJP has its own body framing mechanism which we don't ++ * match against any provided Content-Length, so let the ++ * core determine C-L vs T-E based on what's actually sent. ++ */ ++ if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR)) ++ apr_table_unset(r->headers_out, "Content-Length"); ++ apr_table_unset(r->headers_out, "Transfer-Encoding"); ++ + return APR_SUCCESS; + } + +--- a/modules/proxy/mod_proxy_fcgi.c ++++ b/modules/proxy/mod_proxy_fcgi.c +@@ -764,6 +764,15 @@ recv_again: + + status = ap_scan_script_header_err_brigade_ex(r, ob, + NULL, APLOG_MODULE_INDEX); ++ ++ /* FCGI has its own body framing mechanism which we don't ++ * match against any provided Content-Length, so let the ++ * core determine C-L vs T-E based on what's actually sent. ++ */ ++ if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR)) ++ apr_table_unset(r->headers_out, "Content-Length"); ++ apr_table_unset(r->headers_out, "Transfer-Encoding"); ++ + /* suck in all the rest */ + if (status != OK) { + apr_bucket *tmp_b; +--- a/modules/proxy/mod_proxy_scgi.c ++++ b/modules/proxy/mod_proxy_scgi.c +@@ -388,6 +388,14 @@ static int pass_response(request_rec *r, + return status; + } + ++ /* SCGI has its own body framing mechanism which we don't ++ * match against any provided Content-Length, so let the ++ * core determine C-L vs T-E based on what's actually sent. ++ */ ++ if (!apr_table_get(r->subprocess_env, AP_TRUST_CGILIKE_CL_ENVVAR)) ++ apr_table_unset(r->headers_out, "Content-Length"); ++ apr_table_unset(r->headers_out, "Transfer-Encoding"); ++ + conf = ap_get_module_config(r->per_dir_config, &proxy_scgi_module); + if (conf->sendfile && conf->sendfile != scgi_sendfile_off) { + short err = 1; +--- a/modules/proxy/mod_proxy_uwsgi.c ++++ b/modules/proxy/mod_proxy_uwsgi.c +@@ -385,6 +385,12 @@ static int uwsgi_response(request_rec *r + return HTTP_BAD_GATEWAY; + } + ++ /* T-E wins over C-L */ ++ if (apr_table_get(r->headers_out, "Transfer-Encoding")) { ++ apr_table_unset(r->headers_out, "Content-Length"); ++ backend->close = 1; ++ } ++ + if ((buf = apr_table_get(r->headers_out, "Content-Type"))) { + ap_set_content_type(r, apr_pstrdup(r->pool, buf)); + } diff -Nru apache2-2.4.52/debian/patches/CVE-2024-27316.patch apache2-2.4.52/debian/patches/CVE-2024-27316.patch --- apache2-2.4.52/debian/patches/CVE-2024-27316.patch 1970-01-01 00:00:00.000000000 +0000 +++ apache2-2.4.52/debian/patches/CVE-2024-27316.patch 2024-04-10 17:45:00.000000000 +0000 @@ -0,0 +1,64 @@ +From 0d73970ec161300a55b630f71bbf72b5c41f28b9 Mon Sep 17 00:00:00 2001 +From: Eric Covener +Date: Wed, 3 Apr 2024 12:12:55 +0000 +Subject: [PATCH] Merge r1916771 from trunk: + +bail after too many failed reads + +Submitted By: icing + + + + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1916779 13f79535-47bb-0310-9956-ffa450edef68 +--- + modules/http2/h2_session.c | 10 +++++++--- + modules/http2/h2_stream.c | 1 + + modules/http2/h2_stream.h | 1 + + 3 files changed, 9 insertions(+), 3 deletions(-) + +diff --git a/modules/http2/h2_session.c b/modules/http2/h2_session.c +index 1e560e47792..5724fdadb01 100644 +--- a/modules/http2/h2_session.c ++++ b/modules/http2/h2_session.c +@@ -319,9 +319,13 @@ static int on_header_cb(nghttp2_session *ngh2, const nghttp2_frame *frame, + + status = h2_stream_add_header(stream, (const char *)name, namelen, + (const char *)value, valuelen); +- if (status != APR_SUCCESS +- && (!stream->rtmp +- || stream->rtmp->http_status == H2_HTTP_STATUS_UNSET)) { ++ if (status != APR_SUCCESS && ++ (!stream->rtmp || ++ stream->rtmp->http_status == H2_HTTP_STATUS_UNSET || ++ /* We accept a certain amount of failures in order to reply ++ * with an informative HTTP error response like 413. But if the ++ * client is too wrong, we fail the request a RESET of the stream */ ++ stream->request_headers_failed > 100)) { + return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE; + } + return 0; +diff --git a/modules/http2/h2_stream.c b/modules/http2/h2_stream.c +index f6c92024519..ee87555f9f3 100644 +--- a/modules/http2/h2_stream.c ++++ b/modules/http2/h2_stream.c +@@ -813,6 +813,7 @@ apr_status_t h2_stream_add_header(h2_stream *stream, + + cleanup: + if (error) { ++ ++stream->request_headers_failed; + set_error_response(stream, error); + return APR_EINVAL; + } +diff --git a/modules/http2/h2_stream.h b/modules/http2/h2_stream.h +index d68d426038a..405978a44d6 100644 +--- a/modules/http2/h2_stream.h ++++ b/modules/http2/h2_stream.h +@@ -91,6 +91,7 @@ struct h2_stream { + struct h2_request *rtmp; /* request being assembled */ + apr_table_t *trailers_in; /* optional, incoming trailers */ + int request_headers_added; /* number of request headers added */ ++ int request_headers_failed; /* number of request headers failed to add */ + + #if AP_HAS_RESPONSE_BUCKETS + ap_bucket_response *response; /* the final, non-interim response or NULL */ diff -Nru apache2-2.4.52/debian/patches/fix-dolphin-to-delete-webdav-dirs.patch apache2-2.4.52/debian/patches/fix-dolphin-to-delete-webdav-dirs.patch --- apache2-2.4.52/debian/patches/fix-dolphin-to-delete-webdav-dirs.patch 1970-01-01 00:00:00.000000000 +0000 +++ apache2-2.4.52/debian/patches/fix-dolphin-to-delete-webdav-dirs.patch 2024-01-17 02:56:29.000000000 +0000 @@ -0,0 +1,16 @@ +Description: Recognize dolphin and Konqueror/5 browsers for webdav. + Without these settings, these browsers will be sent redirects on + URLs for directories specified without a trailing '/'. That can + prevent webdav DELETE operations from working. +Author: Michal Maloszewski +Bug: https://bz.apache.org/bugzilla/show_bug.cgi?id=67039 +Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/apache2/+bug/1927742 +Last-Update: 2024-01-16 +--- a/docs/conf/extra/httpd-dav.conf.in ++++ b/docs/conf/extra/httpd-dav.conf.in +@@ -48,3 +48,5 @@ + BrowserMatch "^XML Spy" redirect-carefully + BrowserMatch "^Dreamweaver-WebDAV-SCM1" redirect-carefully + BrowserMatch " Konqueror/4" redirect-carefully ++BrowserMatch " Konqueror/5" redirect-carefully ++BrowserMatch " dolphin/" redirect-carefully diff -Nru apache2-2.4.52/debian/patches/series apache2-2.4.52/debian/patches/series --- apache2-2.4.52/debian/patches/series 2023-10-26 13:44:44.000000000 +0000 +++ apache2-2.4.52/debian/patches/series 2024-04-10 17:45:00.000000000 +0000 @@ -1,3 +1,4 @@ +fix-dolphin-to-delete-webdav-dirs.patch fhs_compliance.patch no_LD_LIBRARY_PATH.patch suexec-CVE-2007-1742.patch @@ -35,3 +36,6 @@ reenable-workers-in-standard-error-state-jammy-apache2.patch update_http2.patch CVE-2023-31122.patch +CVE-2023-38709.patch +CVE-2024-24795.patch +CVE-2024-27316.patch