RE: [users@httpd] CVE-2023-25690: Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy

2023-03-10 Thread Thomas Åkesson
Hi, We are experiencing the effect that a RewriteRule resulting in R (redirect) are blocked (403) with AH10410 despite being encoded before 2.4.56 (the resulting Location header was ok). Is this change intentional? Example: RewriteRule ^/here/([^/]+)(/.*)$

Re: [users@httpd] CVE-2023-25690: Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy

2023-03-10 Thread Eric Covener
On Fri, Mar 10, 2023 at 8:56 AM Thomas Åkesson wrote: > > Hi, > > We are experiencing the effect that a RewriteRule resulting in R (redirect) > are blocked (403) with AH10410 despite being encoded before 2.4.56 (the > resulting Location header was ok). Is this change intentional? > > Example: >

Re: [users@httpd] CVE-2023-25690: Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy

2023-03-10 Thread Eric Covener
> > Try e.g. [R,B= ?,...] > > > > The question mark is to avoid the issue of not being able to have " " > > as the final character in this syntax. > Sorry, the above doesn't work. Someone reported in another thread: [R,B=\ ] > Thanks for the suggestion. I am unable to make 2.4.52 (Ubuntu) accept

Re: [users@httpd] CVE-2023-25690: Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy

2023-03-10 Thread Thomas Åkesson
> On 10 Mar 2023, at 16:32, Eric Covener wrote: > > On Fri, Mar 10, 2023 at 8:56 AM Thomas Åkesson > wrote: >> >> Hi, >> >> We are experiencing the effect that a RewriteRule resulting in R (redirect) >> are blocked (403) with AH10410 despite being encoded before 2.4.56 (the >> resulting