https://bz.apache.org/bugzilla/show_bug.cgi?id=69344
--- Comment #2 from Devendra <devendra.s.da...@wellsfargo.com> --- (In reply to Ruediger Pluem from comment #1) > This is likely caused by the fix for CVE-2024-39573 in 2.4.60 and works as > designed (see why on > https://httpd.apache.org/security/vulnerabilities_24.html). Expect that the > result of each RewriteRule with no Redirect or Proxy flags starts with a '/' > even if the substitution string does not and adjust your RewriteRules to > accommodate for this. Thanks for response - Ruediger Pluem. So, does it mean 2.4.60 and higher versions will add "/" to RewriteRule even it is already present? We have log entry where an additional "/" was added and the application is not working. Should we replace RewriteRule ^(.*) --proto--/$1 [C] with RewriteRule ^(.*) --proto--$1 [C] While testing we observed that with 2.4.62 the rewrite output is having an additional ‘/’ as highlighted below. Apart from that we don’t see any error in trace log. 2.4.62 (failing to error.html) [Mon Aug 19 14:14:47.360450 2024] [rewrite:trace4] [pid 1177:tid 11999] mod_rewrite.c(505): [client <IP_Address>:<port>] <IP_Address> - - [cci-launchpad-dev.hostname.com/sid#700070][rid#7f4468002970/initial] RewriteCond: input='/tv/qa1' pattern='^/(tv)/' [NC] => matched [Mon Aug 19 14:14:47.360468 2024] [rewrite:trace2] [pid 1177:tid 11999] mod_rewrite.c(505): [client <IP_Address>:<port>] <IP_Address> - - [cci-launchpad-dev.hostname.com/sid#700070][rid#7f4468002970/initial] rewrite '/tv-qa-stl-1-vip.hostname.com' -> '--proto--//tv-qa-stl-1-vip.hostname.com' vs 2.4.59 (Working as expected) [Fri Aug 16 13:10:17.778806 2024] [rewrite:trace4] [pid 7669:tid 139952923162048] mod_rewrite.c(493): [client <IP_Address>:<port>] <IP_Address> - - [cci-launchpad-dev.hostname.com/sid#6fb2e0][rid#7f4934002970/initial] RewriteCond: input='/tv/qa1' pattern='^/(tv)/' [NC] => matched [Fri Aug 16 13:10:17.778847 2024] [rewrite:trace2] [pid 7669:tid 139952923162048] mod_rewrite.c(493): [client <IP_Address>:<port>] <IP_Address> - - [cci-launchpad-dev.hostname.com/sid#6fb2e0][rid#7f4934002970/initial] rewrite 'tv-qa-stl-1-vip.hostname.com' -> '--proto--/tv-qa-stl-1-vip.hostname.com' -- You are receiving this mail because: You are the assignee for the bug. --------------------------------------------------------------------- To unsubscribe, e-mail: bugs-unsubscr...@httpd.apache.org For additional commands, e-mail: bugs-h...@httpd.apache.org
