import mod_http2-1.15.7-8.module+el8+1010+deadbeef.3

.mod_http2.checksum

+Direct Git Import

.mod_http2.metadata

-6f52107e47548eee1c45c3fc7a7ca2245a115dd8 SOURCES/mod_http2-1.15.7.tar.gz
+b0d1b783126d9e86d819ad788ebe29af1b76dbc7ceecd100e9a592daeda6ad08 SOURCES/mod_http2-1.15.7.tar.gz

SOURCES/mod_http2-1.15.7-CVE-2023-25690.patch

+diff --git a/mod_http2/mod_proxy_http2.c b/mod_http2/mod_proxy_http2.c
+index 2208707..844653e 100644
+--- a/mod_http2/mod_proxy_http2.c
++++ b/mod_http2/mod_proxy_http2.c
+@@ -159,6 +159,16 @@ static int proxy_http2_canon(request_rec *r, char *url)
+             path = ap_proxy_canonenc(r->pool, url, (int)strlen(url),
+                                      enc_path, 0, r->proxyreq);
+             search = r->args;
++            if (search && *(ap_scan_vchar_obstext(search))) {
++                /*
++                 * We have a raw control character or a ' ' in r->args.
++                 * Correct encoding was missed.
++                 */
++                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10412)
++                              "To be forwarded query string contains control "
++                              "characters or spaces");
++                return HTTP_FORBIDDEN;
++            }
+         }
+         break;
+     case PROXYREQ_PROXY:

SPECS/mod_http2.spec

@@ -3,7 +3,7 @@
 
 Name:		mod_http2
 Version:	1.15.7
-Release:	7%{?dist}
+Release:	8%{?dist}.3
 Summary:	module implementing HTTP/2 for Apache 2
 Group:		System Environment/Daemons
 License:	ASL 2.0
@@ -14,11 +14,12 @@ Patch2:		mod_http2-1.15.7-CVE-2020-11993.patch
 Patch3:		mod_http2-1.15.7-CVE-2021-33193.patch
 Patch4:		mod_http2-1.15.7-CVE-2021-44224.patch
 Patch5:		mod_http2-1.15.7-SNI.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2176209
+Patch6:		mod_http2-1.15.7-CVE-2023-25690.patch
+
 BuildRequires:	pkgconfig, httpd-devel >= 2.4.20, libnghttp2-devel >= 1.7.0, openssl-devel >= 1.0.2
 Requires:	httpd-mmn = %{_httpd_mmn}
-Requires:	httpd >= 2.4.37-47
-Conflicts:      httpd < 2.4.25-8
-
+Conflicts:      httpd < 2.4.37-55
 
 %description
 The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on
@@ -31,6 +32,7 @@ top of libnghttp2 for httpd 2.4 servers.
 %patch3 -p1 -b .CVE-2021-33193
 %patch4 -p1 -b .CVE-2021-44224
 %patch5 -p1 -b .SNI
+%patch6 -p1 -b .CVE-2023-25690
 
 %build
 %configure
@@ -57,6 +59,10 @@ make check
 %{_httpd_moddir}/mod_proxy_http2.so
 
 %changelog
+* Sat Mar 18 2023 Luboš Uhliarik <luhliari@redhat.com> - 1.15.7-8.3
+- Resolves: #2177748 - CVE-2023-25690 httpd:2.4/httpd: HTTP request splitting
+  with mod_rewrite and mod_proxy
+
 * Thu Dec 08 2022 Luboš Uhliarik <luhliari@redhat.com> - 1.15.7-7
 - Resolves: #2095650 - Dependency from mod_http2 on httpd broken