import mod_http2-1.15.19-5.el9

.mod_http2.checksum

+e1a2cc87e2b3b10c2a2940fefe6b469e2c779f5c3a203b262f9a9a48221d0711

.mod_http2.metadata

-90be4a24989a8e0041d9cc20f7db34a453e4fa9f SOURCES/mod_http2-1.15.19.tar.gz
+825d8923a25af3b8175004f2f9dd90c89d3a7e2961c8572ad37af78fda31ac8c SOURCES/mod_http2-1.15.19.tar.gz

SOURCES/mod_http2-1.15.19-CVE-2023-25690.patch

+diff --git a/mod_http2/mod_proxy_http2.c b/mod_http2/mod_proxy_http2.c
+index 893aa8f..d52d5d9 100644
+--- a/mod_http2/mod_proxy_http2.c
++++ b/mod_http2/mod_proxy_http2.c
+@@ -154,11 +154,25 @@ static int proxy_http2_canon(request_rec *r, char *url)
+         if (apr_table_get(r->notes, "proxy-nocanon")) {
+             path = url;   /* this is the raw path */
+         }
++        else if (apr_table_get(r->notes, "proxy-noencode")) {
++            path = url;   /* this is the encoded path already */
++            search = r->args;
++        }
+         else {
+             path = ap_proxy_canonenc(r->pool, url, (int)strlen(url),
+                                      enc_path, 0, r->proxyreq);
+             search = r->args;
+         }
++        if (search && *ap_scan_vchar_obstext(search)) {
++            /*
++             * We have a raw control character or a ' ' in r->args.
++             * Correct encoding was missed.
++             */
++            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10412)
++                          "To be forwarded query string contains control "
++                          "characters or spaces");
++            return HTTP_FORBIDDEN;
++        }
+         break;
+     case PROXYREQ_PROXY:
+         path = url;

SPECS/mod_http2.spec

@@ -3,7 +3,7 @@
 
 Name:		mod_http2
 Version:	1.15.19
-Release:	4%{?dist}
+Release:	5%{?dist}
 Summary:	module implementing HTTP/2 for Apache 2
 License:	ASL 2.0
 URL:		https://icing.github.io/mod_h2/
@@ -14,6 +14,8 @@ Patch2:         mod_http2-1.15.14-openssl30.patch
 # Security patches:
 # https://bugzilla.redhat.com/show_bug.cgi?id=2034672
 Patch100:       mod_http2-1.15.19-CVE-2021-44224.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2176209
+Patch101:       mod_http2-1.15.19-CVE-2023-25690.patch
 
 BuildRequires: make
 BuildRequires:  gcc
@@ -21,7 +23,7 @@ BuildRequires:	pkgconfig, httpd-devel >= 2.4.20, libnghttp2-devel >= 1.7.0, open
 BuildRequires:  autoconf, libtool, /usr/bin/hostname
 Requires:	httpd-mmn = %{_httpd_mmn}
 Requires:	httpd >= 2.4.51-7
-Conflicts:      httpd < 2.4.25-8
+Conflicts:      httpd < 2.4.57
 
 %description
 The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on
@@ -33,6 +35,7 @@ top of libnghttp2 for httpd 2.4 servers.
 %patch2 -p1 -b .openssl30
 
 %patch100 -p1 -b .CVE-2021-44224
+%patch101 -p1 -b .CVE-2023-25690
 
 %build
 autoreconf -i
@@ -57,6 +60,10 @@ echo "LoadModule proxy_http2_module modules/mod_proxy_http2.so" > %{buildroot}%{
 %{_httpd_moddir}/mod_proxy_http2.so
 
 %changelog
+* Wed Aug 16 2023 Luboš Uhliarik <luhliari@redhat.com> - 1.15.19-5
+- Resolves: #2177753 - CVE-2023-25690 httpd: HTTP request splitting with
+  mod_rewrite and mod_proxy
+
 * Mon Dec 05 2022 Luboš Uhliarik <luhliari@redhat.com> - 1.15.19-4
 - Resolves: #2143176 - Dependency from mod_http2 on httpd broken