Bugzilla – Attachment 41538 Details for
Bug 95709
VUL-0: CVE-2005-2088: apache2 request smuggling?
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
IDP Log In
|
Forgot Password
[patch]
httpd-2.0.52-CAN-2005-2088.patch
httpd-2.0.52-CAN-2005-2088.patch (text/plain), 1.17 KB, created by
Ludwig Nussel
on 2005-07-11 06:42:14 UTC
(
hide
)
Description:
httpd-2.0.52-CAN-2005-2088.patch
Filename:
MIME Type:
Creator:
Ludwig Nussel
Created:
2005-07-11 06:42:14 UTC
Size:
1.17 KB
patch
obsolete
>--- httpd-2.0.52/modules/proxy/proxy_http.c.can2088 >+++ httpd-2.0.52/modules/proxy/proxy_http.c >@@ -390,6 +390,13 @@ > int counter, seen_eos; > apr_status_t status; > >+ if (apr_table_get(r->headers_in, "Transfer-Encoding")) { >+ /* Reject chunked requests. */ >+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, >+ "proxy_http: chunked requests not supported"); >+ return HTTP_LENGTH_REQUIRED; >+ } >+ > /* > * Send the HTTP/1.1 request to the remote server > */ >--- httpd-2.0.52/server/protocol.c.can2088 >+++ httpd-2.0.52/server/protocol.c >@@ -962,6 +962,15 @@ > ap_run_log_transaction(r); > return r; > } >+ >+ if (apr_table_get(r->headers_in, "Transfer-Encoding") >+ && apr_table_get(r->headers_in, "Content-Length")) { >+ /* 2616 section 4.4, point 3: "if both Transfer-Encoding >+ * and Content-Length are received, the latter MUST be >+ * ignored"; so unset it here to prevent any confusion >+ * later. */ >+ apr_table_unset(r->headers_in, "Content-Length"); >+ } > } > > ap_add_input_filter_handle(ap_http_input_filter_handle,
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
Actions:
View
|
Diff
Attachments on
bug 95709
:
41427
| 41538 |
44777
|
44785