Fedora Account System
Red Hat Associate
Red Hat Customer
A bug has been introduced between 2.4.67 and 2.4.68 of the httpd package having to do with URL translation when using a reverse proxy. In the ssl.conf file I have (hostname changed to protect the innocent): ProxyPass "/workbench" "http://host.example.org:8000" ProxyPassReverse "/workbench" "http://host.example.org:8000" ProxyHTMLURLMap "http://host.example.org:8000" "/workbench" <Location /workbench> Require all granted ProxyHTMLEnable On ProxyHTMLURLMap "/" "/workbench/" </Location> When I access a link under this /workbench URL, I get the document from the proxied server, but near some of the links in the document, garbage gets introduced. The pattern I saw was this: whenever a link inside an html tag was modified, and the html tag is followed by an html comment, garbage is introduced after the comment. For instance, a piece of document as it comes from the proxied server (retrieved using wget on the server httpd runs on) is: <link rel="shortcut icon" type="image/png" href="/static/images/favicon.png"> <!-- Font Awesome Icons --> <link rel="stylesheet" href="/static/plugins/fontawesome-free/css/all.min.css"> When I look at this document when retrieved through a 2.4.67 httpd server, I get: <link rel="shortcut icon" type="image/png" href="/workbench/static/images/favicon.png"><!-- Font Awesome Icons --><link rel="stylesheet" href="/workbench/static/plugins/fontawesome-free/css/all.min.css"> But when I use a 2.4.68 httpd server, I get: <link rel="shortcut icon" type="image/png" href="/workbench/static/images/favicon.png"><!-- Font Awesome Icons -->v^?^@^@<A0>O^B<90>v^?^@^@<E0>^K^@<90>v^?^@^@/workbe/wo<link rel="stylesheet" href="/workbench/static/plugins/fontawesome-free/css/all.min.css"> The exact gibberish varies. When I set ProxyHTMLEnable to Off in the 2.4.68 httpd server config, the document is not garbled (but doesn't work because the links are broken). I have not seen garbage introduced in places where a link gets replaced but there is no following comment. Reproducible: Always Steps to Reproduce: 1.See the Details section above. 2. 3. Actual Results: non-working document that contains garbage characters Expected Results: working document
Can you provide the exact backend HTML needed to reproduce this?
Created attachment 2147790 [details] html page without transformations If I understand correctly, this is what you're asking for. This is the document retrieved on the system on which the proxy is running, but without using said proxy. So this is the input for the transformations.
Thanks, I think I've reproduced it. Can you try this scratch build please? https://koji.fedoraproject.org/koji/taskinfo?taskID=147476325 (We unfortunately don't have good test coverage for mod_proxy_html upstream so the security fix broke things here)
Yes, this looks a lot better. The page is displaying properly now. I'll keep running for a while longer with this version.
I've used this build for several weeks now and I've not seen any problems. Is there a time frame for when this an be pushed to the update repo? I'm waiting for the fix to land in Fedora 44 before I will upgrade the system.
Can you please push the fix to the repositories? It's been sitting there for two months already.
FEDORA-2026-34b2d69632 (httpd-2.4.69-1.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-34b2d69632
FEDORA-2026-b6d445cd3e (httpd-2.4.69-1.fc45) has been submitted as an update to Fedora 45. https://bodhi.fedoraproject.org/updates/FEDORA-2026-b6d445cd3e
FEDORA-2026-b6d445cd3e has been pushed to the Fedora 45 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-b6d445cd3e` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-b6d445cd3e See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-34b2d69632 has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-34b2d69632` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-34b2d69632 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-d3cec01bde has been pushed to the Fedora 43 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-d3cec01bde` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-d3cec01bde See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-34b2d69632 (httpd-2.4.69-1.fc44) has been pushed to the Fedora 44 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2026-d3cec01bde (httpd-2.4.69-1.fc43) has been pushed to the Fedora 43 stable repository. If problem still persists, please make note of it in this bug report.