Re: [users@httpd] CVE-2023-25690: Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy

2023-03-13 Thread Thomas Åkesson
>>> Thanks for the suggestion. I am unable to make 2.4.52 (Ubuntu) accept space >>> for the B-flag. I have tried first, middle, last, only flag but always >>> getting "RewriteRule: bad flag delimiters". >>> >>> I am also having concerns whether this would work (unable to test at this >>>

Re: [users@httpd] CVE-2023-25690: Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy

2023-03-13 Thread Thomas Åkesson
Try e.g. [R,B= ?,...] The question mark is to avoid the issue of not being able to have " " as the final character in this syntax. >>> >> >> Sorry, the above doesn't work. Someone reported in another thread: [R,B=\ ] > > The real trick seems to be quoting the entirety of

Re: [users@httpd] CVE-2023-25690: Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy

2023-03-10 Thread Thomas Åkesson
> On 10 Mar 2023, at 16:32, Eric Covener wrote: > > On Fri, Mar 10, 2023 at 8:56 AM Thomas Åkesson > wrote: >> >> Hi, >> >> We are experiencing the effect that a RewriteRule resulting in R (redirect) >> are blocked (403) with AH10410 despite bein

RE: [users@httpd] CVE-2023-25690: Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy

2023-03-10 Thread Thomas Åkesson
Hi, We are experiencing the effect that a RewriteRule resulting in R (redirect) are blocked (403) with AH10410 despite being encoded before 2.4.56 (the resulting Location header was ok). Is this change intentional? Example: RewriteRule ^/here/([^/]+)(/.*)$