Bug 2189179 - mod_rewrite regression with CVE-2023-25690
Summary: mod_rewrite regression with CVE-2023-25690
Keywords:
Status: VERIFIED
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: httpd
Version: 8.9
Hardware: Unspecified
OS: Unspecified
urgent
urgent
Target Milestone: rc
: ---
Assignee: Luboš Uhliarik
QA Contact: icesalov
URL:
Whiteboard:
Depends On:
Blocks: 2190133 2190134 2190135
TreeView+ depends on / blocked
 
Reported: 2023-04-24 11:06 UTC by Joe Orton
Modified: 2023-08-11 13:04 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 2190133 2190134 2190135 (view as bug list)
Environment:
Last Closed:
Type: Bug
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker RHELPLAN-155507 0 None None None 2023-04-24 11:07:19 UTC

Description Joe Orton 2023-04-24 11:06:04 UTC 
Description of problem:
Regression in query string handling with mod_rewrite due to CVE-2023-25690.

mod_rewrite BCTLS and BNE flags should also be added to allow finer control of escaping behaviour in rewrites, mitigating issues with certain configurations.

https://svn.apache.org/viewvc?view=revision&revision=1908301

Version-Release number of selected component (if applicable):
httpd-2.4.37-51.2

How reproducible:
always

Steps to Reproduce:
See https://bz.apache.org/bugzilla/show_bug.cgi?id=66547
Comment 13 Shabba 2023-08-11 13:04:01 UTC 
Just curious how things are going with this and if there's ETA on updated release?  Thanks
Note You need to log in before you can comment on or make changes to this bug.