Bug#995368: libapache2-mod-proxy-uwsgi - CVE-2021-36160 regression, altered PATH_INFO

2021-12-01 Thread Sylvain Beucler
The regression fix is now officially staged upstream for 2.4.52: https://github.com/apache/httpd/commit/8966e290a6e947fad0289bf4e243b0b552e13726 Cheers! Sylvain Beucler Debian LTS Team

Bug#995368: libapache2-mod-proxy-uwsgi - CVE-2021-36160 regression, altered PATH_INFO

2021-10-09 Thread philippe . accorsi
Hi, Thanks for your answer but also thanks for the information about wrong configuration of apache. I have tested both solution you explain here and both works good. If I apply change in Apache configuration (like explain in the official documentation about "/") my app works good. If I

Bug#995368: libapache2-mod-proxy-uwsgi - CVE-2021-36160 regression, altered PATH_INFO

2021-10-09 Thread Sylvain Beucler
Hi, On 05/10/2021 18:41, Sylvain Beucler wrote: forwarded 995368 https://bz.apache.org/bugzilla/show_bug.cgi?id=65616 The Apache developers say there's an incorrect configuration in the first place. For example, ProxyPassMatch ^/ui uwsgi://127.0.0.1:8081/ should be ProxyPassMatch ^/ui

Bug#995368: libapache2-mod-proxy-uwsgi - CVE-2021-36160 regression, altered PATH_INFO

2021-10-05 Thread Sylvain Beucler
tags 995368 + upstream forwarded 995368 https://bz.apache.org/bugzilla/show_bug.cgi?id=65616 thanks Note: there doesn't seem to be actual path duplication at the UWSGI level, AFAICS Django just gets confused by the additional '/' at the start of PATH_INFO and incorrectly duplicates the path in