From 6d4ca6868bb6195f3c4cc785a1a8afc1af10f7e2 Mon Sep 17 00:00:00 2001 From: Joe Slater Date: Thu, 27 Oct 2016 09:48:43 -0700 Subject: apache2: cve-2016-5387 Handle HTTP_PROXY envirnoment variable. Signed-off-by: Joe Slater Signed-off-by: Martin Jansa --- .../apache2/apache2/cve-2016-5387.patch | 25 ++++++++++++++++++++++ .../recipes-httpd/apache2/apache2_2.4.23.bb | 1 + 2 files changed, 26 insertions(+) create mode 100644 meta-webserver/recipes-httpd/apache2/apache2/cve-2016-5387.patch (limited to 'meta-webserver') diff --git a/meta-webserver/recipes-httpd/apache2/apache2/cve-2016-5387.patch b/meta-webserver/recipes-httpd/apache2/apache2/cve-2016-5387.patch new file mode 100644 index 000000000..dbcdfc6df --- /dev/null +++ b/meta-webserver/recipes-httpd/apache2/apache2/cve-2016-5387.patch @@ -0,0 +1,25 @@ +This patch has been copied from https://www.apache.org/security/asf-httpoxy-response.txt +as a mitigation of CVE-2016-5387. + +Upstream-Status: Backport - fixed in 2.4.24 + +Signed-off-by: Joe Slater + + +--- a/server/util_script.c (revision 1752426) ++++ b/server/util_script.c (working copy) +@@ -186,6 +186,14 @@ AP_DECLARE(void) ap_add_common_vars(request_rec *r + else if (!strcasecmp(hdrs[i].key, "Content-length")) { + apr_table_addn(e, "CONTENT_LENGTH", hdrs[i].val); + } ++ /* HTTP_PROXY collides with a popular envvar used to configure ++ * proxies, don't let clients set/override it. But, if you must... ++ */ ++#ifndef SECURITY_HOLE_PASS_PROXY ++ else if (!strcasecmp(hdrs[i].key, "Proxy")) { ++ ; ++ } ++#endif + /* + * You really don't want to disable this check, since it leaves you + * wide open to CGIs stealing passwords and people viewing them diff --git a/meta-webserver/recipes-httpd/apache2/apache2_2.4.23.bb b/meta-webserver/recipes-httpd/apache2/apache2_2.4.23.bb index be24998d1..7656595c8 100644 --- a/meta-webserver/recipes-httpd/apache2/apache2_2.4.23.bb +++ b/meta-webserver/recipes-httpd/apache2/apache2_2.4.23.bb @@ -17,6 +17,7 @@ SRC_URI = "http://www.apache.org/dist/httpd/httpd-${PV}.tar.bz2 \ file://httpd-2.4.3-fix-race-issue-of-dir-install.patch \ file://0001-configure-use-pkg-config-for-PCRE-detection.patch \ file://configure-allow-to-disable-selinux-support.patch \ + file://cve-2016-5387.patch \ file://init \ file://apache2-volatile.conf \ file://apache2.service \ -- cgit v1.2.3-54-g00ecf