From 05d86ee021a2f8540cac6d8abcc0bc2cf4e073d9 Mon Sep 17 00:00:00 2001 From: eaglegai Date: Fri, 15 Aug 2025 03:26:01 +0000 Subject: [PATCH] fix CVE-2025-49630 --- backport-CVE-2025-49630.patch | 43 +++++++++++++++++++++++++++++++++++ mod_http2.spec | 9 +++++++- 2 files changed, 51 insertions(+), 1 deletion(-) create mode 100644 backport-CVE-2025-49630.patch diff --git a/backport-CVE-2025-49630.patch b/backport-CVE-2025-49630.patch new file mode 100644 index 0000000..6b624ee --- /dev/null +++ b/backport-CVE-2025-49630.patch @@ -0,0 +1,43 @@ +From 88304321841a2fe8bd5eacc70e69418b0b545ca5 Mon Sep 17 00:00:00 2001 +From: Eric Covener +Date: Mon, 7 Jul 2025 12:05:49 +0000 +Subject: [PATCH] backport 1927036 from trunk + + tolerate missing host header in h2 proxy + +Reviewed By: jorton, icing, rpluem + + + +git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1927044 13f79535-47bb-0310-9956-ffa450edef68 + +Conflict:change orig_host to r->hostname +Reference:https://github.com/apache/httpd/commit/88304321841a2fe8bd5eacc70e69418b0b545ca5 + +--- + mod_http2/h2_proxy_session.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/mod_http2/h2_proxy_session.c b/mod_http2/h2_proxy_session.c +index d5d0f9bc6bc..2cfbb5f5d4b 100644 +--- a/mod_http2/h2_proxy_session.c ++++ b/mod_http2/h2_proxy_session.c +@@ -850,6 +850,18 @@ static apr_status_t open_stream(h2_proxy_session *session, const char *url, + dconf = ap_get_module_config(r->per_dir_config, &proxy_module); + if (dconf->preserve_host) { + authority = r->hostname; ++ if (!authority) { ++ /* Duplicate mod_proxy behaviour if ProxyPreserveHost is ++ * used but an "HTTP/0.9" request is received without a ++ * Host: header */ ++ authority = r->server->server_hostname; ++ ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, APLOGNO(10511) ++ "HTTP/0.9 request (with no host line) " ++ "on incoming request and preserve host set " ++ "forcing hostname to be %s for uri %s", ++ authority, r->uri); ++ apr_table_setn(r->headers_in, "Host", authority); ++ } + } + else { + authority = puri.hostname; diff --git a/mod_http2.spec b/mod_http2.spec index 6d2d171..688cfa8 100644 --- a/mod_http2.spec +++ b/mod_http2.spec @@ -2,13 +2,14 @@ Name: mod_http2 Version: 1.15.13 -Release: 2 +Release: 3 Summary: Support for the HTTP/2 transport layer License: ASL 2.0 URL: https://icing.github.io/mod_h2/ Source0: https://github.com/icing/mod_h2/releases/download/v%{version}/%{name}-%{version}.tar.gz Patch1: fix-build-with-earlier-2.4.x-which-don-t-define-AP_S.patch Patch2: backport-CVE-2024-27316.patch +Patch3: backport-CVE-2025-49630.patch BuildRequires: gcc pkgconfig httpd-devel libnghttp2-devel openssl-devel Requires: httpd-mmn = %{_httpd_mmn} @@ -49,6 +50,12 @@ make check %exclude /etc/httpd/share/doc/* %changelog +* Fri Aug 15 2025 gaihuiying - 1.15.13-3 +- Type:cves +- CVE:CVE-2025-49630 +- SUG:NA +- DESC:fix CVE-2025-49630 + * Sun Apr 07 2024 gaihuiying - 1.15.13-2 - Type:cves - CVE:CVE-2024-27316 -- Gitee