From a2846a702b9375c1910ba309921d020dc3423a0b Mon Sep 17 00:00:00 2001 From: chengyechun Date: Fri, 17 Jun 2022 16:25:08 +0800 Subject: [PATCH] backport CVE-2022-28615 --- backport-CVE-2022-28615.patch | 34 ++++++++++++++++++++++++++++++++++ httpd.spec | 9 ++++++++- 2 files changed, 42 insertions(+), 1 deletion(-) create mode 100644 backport-CVE-2022-28615.patch diff --git a/backport-CVE-2022-28615.patch b/backport-CVE-2022-28615.patch new file mode 100644 index 0000000..cf371ad --- /dev/null +++ b/backport-CVE-2022-28615.patch @@ -0,0 +1,34 @@ +From 929c7156cefdd2f74f83dcab2b15b2d09e80ec82 Mon Sep 17 00:00:00 2001 +From: covener +Date: Wed Jun 1 12:20:56 2022 UTC +Subject: [PATCH] ap_strcasecmp_match/ap_strcmp_match:fix types + +--- + server/util.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/server/util.c b/server/util.c +index 633648c..09ac0c5 100644 +--- a/server/util.c ++++ b/server/util.c +@@ -185,7 +185,7 @@ AP_DECLARE(char *) ap_ht_time(apr_pool_t *p, apr_time_t t, const char *fmt, + */ + AP_DECLARE(int) ap_strcmp_match(const char *str, const char *expected) + { +- int x, y; ++ apr_size_t x, y; + + for (x = 0, y = 0; expected[y]; ++y, ++x) { + if (expected[y] == '*') { +@@ -209,7 +209,7 @@ AP_DECLARE(int) ap_strcmp_match(const char *str, const char *expected) + + AP_DECLARE(int) ap_strcasecmp_match(const char *str, const char *expected) + { +- int x, y; ++ apr_size_t x, y; + + for (x = 0, y = 0; expected[y]; ++y, ++x) { + if (!str[x] && expected[y] != '*') +-- +1.8.3.1 + diff --git a/httpd.spec b/httpd.spec index 1eee8fd..c2befc0 100644 --- a/httpd.spec +++ b/httpd.spec @@ -8,7 +8,7 @@ Name: httpd Summary: Apache HTTP Server Version: 2.4.51 -Release: 6 +Release: 7 License: ASL 2.0 URL: https://httpd.apache.org/ Source0: https://archive.apache.org/dist/httpd/httpd-%{version}.tar.bz2 @@ -78,6 +78,7 @@ Patch24: backport-CVE-2021-44790.patch Patch25: backport-001-CVE-2021-44224.patch Patch26: backport-002-CVE-2021-44224.patch Patch27: backport-Switch-from-PCRE-to-PCRE2.patch +Patch28: backport-CVE-2022-28615.patch BuildRequires: gcc autoconf pkgconfig findutils xmlto perl-interpreter perl-generators systemd-devel BuildRequires: zlib-devel libselinux-devel lua-devel brotli-devel @@ -510,6 +511,12 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Fri Jun 17 2022 chengyechun - 2.4.51-6 +- Type:CVE +- ID:NA +- SUG:restart +- DESC:fix CVE-2022-28615 + * Mon May 30 2022 chengyechun - 2.4.51-6 - Type:bugfix - ID:NA -- Gitee