Re: CVE-2023-25690: Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



>>> Thanks for the suggestion. I am unable to make 2.4.52 (Ubuntu) accept space for the B-flag. I have tried first, middle, last, only flag but always getting "RewriteRule: bad flag delimiters".
>>> 
>>> I am also having concerns whether this would work (unable to test at this time).
>>> - The spaces would likely be double-encoded unless adding NE
>> 
>> In your case, with just B you'd end up with space->+ and the default
>> escaping w/o NE does not touch a +.
> 
> After some additional experiments I was leaning towards "[R,B= +,...]" since a plus character would otherwise be confused with space (was actually a bug before when using [R, ...]). 

To be clear, with "bug" I meant a bug in the platform that I maintain where httpd is a component. I am not saying it's a bug in httpd.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx





[Index of Archives]     [Open SSH Users]     [Linux ACPI]     [Linux Kernel]     [Linux Laptop]     [Kernel Newbies]     [Security]     [Netfilter]     [Bugtraq]     [Squid]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Samba]     [Video 4 Linux]     [Device Mapper]

  Powered by Linux