Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.user > #178566
| From | Juha Heinanen <jh@tutpro.com> |
|---|---|
| Newsgroups | linux.debian.user |
| Subject | why does latest jessie apache2 reject _ in http request path? |
| Date | 2017-03-08 08:20 +0100 |
| Message-ID | <tiE37-35s-9@gated-at.bofh.it> (permalink) |
| Organization | linux.* mail to news gateway |
My web app stopped working in apache2 2.4.10-10+deb8u8 and looks like
the reason is this:
* CVE-2016-8743: Enforce more HTTP conformance for request lines and
request headers, to prevent response splitting and cache pollution
by malicious clients or downstream proxies.
If this causes problems with non-conforming clients, some checks can
be relaxed by adding the new directive 'HttpProtocolOptions unsafe'
to the configuration.
Differently than the upstream 2.4.25 release which will also be in the
Debian 9 (stretch) release, this update for Debian 8 (jessie) accepts
underscores in host and domain names even while 'HttpProtocolOptions
strict' is in effect.
More information is available at
http://httpd.apache.org/docs/2.4/mod/core.html#httpprotocoloptions
I checked at the referenced RFCs and underscore IS a valid character in
a segment (rfc3986):
absolute-path = 1*( "/" segment )
segment = *pchar
pchar = unreserved / pct-encoded / sub-delims / ":" / "@"
unreserved = ALPHA / DIGIT / "-" / "." / "_" / "~"
Why is it that if I have _ in my segment, apache2 rejects the request
without 'HttpProtocolOptions strict'?
-- Juha
Back to linux.debian.user | Previous | Next — Next in thread | Find similar | Unroll thread
why does latest jessie apache2 reject _ in http request path? Juha Heinanen <jh@tutpro.com> - 2017-03-08 08:20 +0100
Re: why does latest jessie apache2 reject _ in http request path? <tomas@tuxteam.de> - 2017-03-08 10:20 +0100
Re: why does latest jessie apache2 reject _ in http request path? Juha Heinanen <jh@tutpro.com> - 2017-03-08 10:40 +0100
Re: why does latest jessie apache2 reject _ in http request path? Juha Heinanen <jh@tutpro.com> - 2017-03-08 10:50 +0100
Re: why does latest jessie apache2 reject _ in http request path? tomas@tuxteam.de - 2017-03-08 11:00 +0100
Re: why does latest jessie apache2 reject _ in http request path sf@debian.org - 2017-03-08 12:00 +0100
Re: why does latest jessie apache2 reject _ in http request path Juha Heinanen <jh@tutpro.com> - 2017-03-08 21:10 +0100
Re: why does latest jessie apache2 reject _ in http request path Greg Wooledge <wooledg@eeg.ccf.org> - 2017-03-08 21:10 +0100
csiph-web