diff --git a/backport-CVE-2025-49630.patch b/backport-CVE-2025-49630.patch deleted file mode 100644 index ab1a2d767eaa72331e48a2cbd2236f55e2781ffe..0000000000000000000000000000000000000000 --- a/backport-CVE-2025-49630.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 88304321841a2fe8bd5eacc70e69418b0b545ca5 Mon Sep 17 00:00:00 2001 -From: Eric Covener -Date: Mon, 7 Jul 2025 12:05:49 +0000 -Subject: [PATCH] backport 1927036 from trunk - - tolerate missing host header in h2 proxy - -Reviewed By: jorton, icing, rpluem - - - -git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1927044 13f79535-47bb-0310-9956-ffa450edef68 - -Conflict:NA -Reference:https://github.com/apache/httpd/commit/88304321841a2fe8bd5eacc70e69418b0b545ca5 - ---- - mod_http2/h2_proxy_session.c | 12 ++++++++++++ - 1 file changed, 12 insertions(+) - -diff --git a/mod_http2/h2_proxy_session.c b/mod_http2/h2_proxy_session.c -index d5d0f9bc6bc..2cfbb5f5d4b 100644 ---- a/mod_http2/h2_proxy_session.c -+++ b/mod_http2/h2_proxy_session.c -@@ -850,6 +850,18 @@ static apr_status_t open_stream(h2_proxy_session *session, const char *url, - dconf = ap_get_module_config(r->per_dir_config, &proxy_module); - if (dconf->preserve_host) { - authority = orig_host; -+ if (!authority) { -+ /* Duplicate mod_proxy behaviour if ProxyPreserveHost is -+ * used but an "HTTP/0.9" request is received without a -+ * Host: header */ -+ authority = r->server->server_hostname; -+ ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, APLOGNO(10511) -+ "HTTP/0.9 request (with no host line) " -+ "on incoming request and preserve host set " -+ "forcing hostname to be %s for uri %s", -+ authority, r->uri); -+ apr_table_setn(r->headers_in, "Host", authority); -+ } - } - else { - authority = puri.hostname; diff --git a/mod_http2-2.0.31.tar.gz b/mod_http2-2.0.31.tar.gz deleted file mode 100644 index d3dbf65c490433fe9a74113d2d8714bc1f703497..0000000000000000000000000000000000000000 Binary files a/mod_http2-2.0.31.tar.gz and /dev/null differ diff --git a/mod_http2-2.0.35.tar.gz b/mod_http2-2.0.35.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..1e89f0a98bac1a3066309639eb7cf34d3bfe131d Binary files /dev/null and b/mod_http2-2.0.35.tar.gz differ diff --git a/mod_http2.spec b/mod_http2.spec index 9a35ce1481bd2bda0442a544e4f63946ff36d9f3..b0822641a4a8355fa76eff0ad3ad02eeb2c6a153 100644 --- a/mod_http2.spec +++ b/mod_http2.spec @@ -1,15 +1,13 @@ %{!?_httpd_mmn: %global _httpd_mmn %(cat %{_includedir}/httpd/.mmn 2>/dev/null || echo 0-0)} Name: mod_http2 -Version: 2.0.31 -Release: 2 +Version: 2.0.35 +Release: 1 Summary: Support for the HTTP/2 transport layer License: Apache-2.0 URL: https://icing.github.io/mod_h2/ Source0: https://github.com/icing/mod_h2/releases/download/v%{version}/%{name}-%{version}.tar.gz -Patch0: backport-CVE-2025-49630.patch - BuildRequires: make gcc pkgconfig httpd-devel >= 2.4.20 libnghttp2-devel >= 1.7.0 openssl-devel >= 1.0.2 autoconf libtool hostname Requires: httpd-mmn = %{_httpd_mmn} @@ -50,6 +48,12 @@ make check %doc ChangeLog README README.md %changelog +* Fri Sep 05 2025 gaihuiying - 2.0.35-1 +- Type:requirement +- CVE:NA +- SUG:NA +- DESC: update mod_http2 to 2.0.35 + * Fri Aug 15 2025 gaihuiying - 2.0.31-2 - Type:cves - CVE:CVE-2025-49630