Bug 749071

Summary: httpd: RHSA-2011:1329 and RHSA-2011:1330 range 0- handling regression
Product: [JBoss] JBoss Enterprise Web Server 1 Reporter: David Jorm <djorm>
Component: httpd22Assignee: Permaine Cheung <pcheung>
Status: CLOSED ERRATA QA Contact:
Severity: urgent Docs Contact:
Priority: urgent    
Version: 1.0.2CC: mjc
Target Milestone: ---Keywords: Regression
Target Release: ---   
Hardware: All   
OS: All   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-05-07 19:04:48 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description David Jorm 2011-10-26 03:43:54 UTC 
Description of problem:
RHSA-2011:1329 and RHSA-2011:1330 provided a fix for CVE-2011-3192, which significantly changed ranges handling code and resulted in a following regression:

Range specification of 0- was returning response 200 rather than 206, which may be expected by some clients:

https://issues.apache.org/bugzilla/show_bug.cgi?id=51878

Fixed upstream in:

http://svn.apache.org/viewvc?view=revision&revision=1175980
http://svn.apache.org/viewvc?view=revision&revision=1175992

Return code 200 was an optimization to make httpd return complete file is sum of sizes of all ranges was equal to or higher than file size.  The above patches ensure the optimization is only used when sum of all ranges exceeds file size.
Comment 3 errata-xmlrpc 2012-05-07 19:04:48 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2012-0542.html