new version 2.4.53

fixes CVE-2022-23943, CVE-2022-22721, CVE-2022-22720 and CVE-2022-22719

.gitignore

@@ -42,3 +42,4 @@ x86_64
 /httpd-2.4.49.tar.bz2.asc
 /httpd-2.4.50.tar.bz2.asc
 /httpd-2.4.51.tar.bz2.asc
+/httpd-2.4.53.tar.bz2.asc

httpd-2.4.48-openssl3.patch

@@ -1,505 +0,0 @@
-
-https://github.com/apache/httpd/pull/258
-
-diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
-index 4da24eddcc..5d199cddaf 100644
---- a/modules/ssl/ssl_engine_init.c
-+++ b/modules/ssl/ssl_engine_init.c
-@@ -91,7 +91,6 @@ static int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNUM *q, BIGNUM *g)
- 
-     return 1;
- }
--#endif
- 
- /*
-  * Grab well-defined DH parameters from OpenSSL, see the BN_get_rfc*
-@@ -171,6 +170,7 @@ DH *modssl_get_dh_params(unsigned keylen)
-         
-     return NULL; /* impossible to reach. */
- }
-+#endif
- 
- static void ssl_add_version_components(apr_pool_t *ptemp, apr_pool_t *pconf,
-                                        server_rec *s)
-@@ -440,8 +440,9 @@ apr_status_t ssl_init_Module(apr_pool_t *p, apr_pool_t *plog,
- 
-     modssl_init_app_data2_idx(); /* for modssl_get_app_data2() at request time */
- 
-+#if MODSSL_USE_OPENSSL_PRE_1_1_API
-     init_dh_params();
--#if !MODSSL_USE_OPENSSL_PRE_1_1_API
-+#else
-     init_bio_methods();
- #endif
- 
-@@ -834,7 +835,11 @@ static void ssl_init_ctx_callbacks(server_rec *s,
- {
-     SSL_CTX *ctx = mctx->ssl_ctx;
- 
-+#if MODSSL_USE_OPENSSL_PRE_1_1_API
-     SSL_CTX_set_tmp_dh_callback(ctx,  ssl_callback_TmpDH);
-+#else
-+    SSL_CTX_set_dh_auto(ctx, 1);
-+#endif
- 
-     SSL_CTX_set_info_callback(ctx, ssl_callback_Info);
- 
-@@ -843,6 +848,23 @@ static void ssl_init_ctx_callbacks(server_rec *s,
- #endif
- }
- 
-+static APR_INLINE
-+int modssl_CTX_load_verify_locations(SSL_CTX *ctx,
-+                                     const char *file,
-+                                     const char *path)
-+{
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+    if (!SSL_CTX_load_verify_locations(ctx, file, path))
-+        return 0;
-+#else
-+    if (file && !SSL_CTX_load_verify_file(ctx, file))
-+        return 0;
-+    if (path && !SSL_CTX_load_verify_dir(ctx, path))
-+        return 0;
-+#endif
-+    return 1;
-+}
-+
- static apr_status_t ssl_init_ctx_verify(server_rec *s,
-                                         apr_pool_t *p,
-                                         apr_pool_t *ptemp,
-@@ -883,10 +905,8 @@ static apr_status_t ssl_init_ctx_verify(server_rec *s,
-         ap_log_error(APLOG_MARK, APLOG_TRACE1, 0, s,
-                      "Configuring client authentication");
- 
--        if (!SSL_CTX_load_verify_locations(ctx,
--                                           mctx->auth.ca_cert_file,
--                                           mctx->auth.ca_cert_path))
--        {
-+        if (!modssl_CTX_load_verify_locations(ctx, mctx->auth.ca_cert_file,
-+                                                   mctx->auth.ca_cert_path)) {
-             ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01895)
-                     "Unable to configure verify locations "
-                     "for client authentication");
-@@ -971,6 +991,23 @@ static apr_status_t ssl_init_ctx_cipher_suite(server_rec *s,
-     return APR_SUCCESS;
- }
- 
-+static APR_INLINE
-+int modssl_X509_STORE_load_locations(X509_STORE *store,
-+                                     const char *file,
-+                                     const char *path)
-+{
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+    if (!X509_STORE_load_locations(store, file, path))
-+        return 0;
-+#else
-+    if (file && !X509_STORE_load_file(store, file))
-+        return 0;
-+    if (path && !X509_STORE_load_path(store, path))
-+        return 0;
-+#endif
-+    return 1;
-+}
-+
- static apr_status_t ssl_init_ctx_crl(server_rec *s,
-                                      apr_pool_t *p,
-                                      apr_pool_t *ptemp,
-@@ -1009,8 +1046,8 @@ static apr_status_t ssl_init_ctx_crl(server_rec *s,
-     ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(01900)
-                  "Configuring certificate revocation facility");
- 
--    if (!store || !X509_STORE_load_locations(store, mctx->crl_file,
--                                             mctx->crl_path)) {
-+    if (!store || !modssl_X509_STORE_load_locations(store, mctx->crl_file,
-+                                                           mctx->crl_path)) {
-         ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01901)
-                      "Host %s: unable to configure X.509 CRL storage "
-                      "for certificate revocation", mctx->sc->vhost_id);
-@@ -1239,6 +1276,31 @@ static int ssl_no_passwd_prompt_cb(char *buf, int size, int rwflag,
-    return 0;
- }
- 
-+static APR_INLINE int modssl_DH_bits(DH *dh)
-+{
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+    return DH_bits(dh);
-+#else
-+    return BN_num_bits(DH_get0_p(dh));
-+#endif
-+}
-+
-+/* SSL_CTX_use_PrivateKey_file() can fail either because the private
-+ * key was encrypted, or due to a mismatch between an already-loaded
-+ * cert and the key - a common misconfiguration - from calling
-+ * X509_check_private_key().  This macro is passed the last error code
-+ * off the OpenSSL stack and evaluates to true only for the first
-+ * case.  With OpenSSL < 3 the second case is identifiable by the
-+ * function code, but function codes are not used from 3.0. */
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+#define CHECK_PRIVKEY_ERROR(ec) (ERR_GET_FUNC(ec) != X509_F_X509_CHECK_PRIVATE_KEY)
-+#else
-+#define CHECK_PRIVKEY_ERROR(ec) (ERR_GET_LIB != ERR_LIB_X509            \
-+                                 || (ERR_GET_REASON(ec) != X509_R_KEY_TYPE_MISMATCH \
-+                                     && ERR_GET_REASON(ec) != X509_R_KEY_VALUES_MISMATCH \
-+                                     && ERR_GET_REASON(ec) != X509_R_UNKNOWN_KEY_TYPE))
-+#endif
-+
- static apr_status_t ssl_init_server_certs(server_rec *s,
-                                           apr_pool_t *p,
-                                           apr_pool_t *ptemp,
-@@ -1249,7 +1311,7 @@ static apr_status_t ssl_init_server_certs(server_rec *s,
-     const char *vhost_id = mctx->sc->vhost_id, *key_id, *certfile, *keyfile;
-     int i;
-     X509 *cert;
--    DH *dhparams;
-+    DH *dh;
- #ifdef HAVE_ECC
-     EC_GROUP *ecparams = NULL;
-     int nid;
-@@ -1344,8 +1406,7 @@ static apr_status_t ssl_init_server_certs(server_rec *s,
-         }
-         else if ((SSL_CTX_use_PrivateKey_file(mctx->ssl_ctx, keyfile,
-                                               SSL_FILETYPE_PEM) < 1)
--                 && (ERR_GET_FUNC(ERR_peek_last_error())
--                     != X509_F_X509_CHECK_PRIVATE_KEY)) {
-+                 && CHECK_PRIVKEY_ERROR(ERR_peek_last_error())) {
-             ssl_asn1_t *asn1;
-             const unsigned char *ptr;
- 
-@@ -1434,12 +1495,12 @@ static apr_status_t ssl_init_server_certs(server_rec *s,
-      */
-     certfile = APR_ARRAY_IDX(mctx->pks->cert_files, 0, const char *);
-     if (certfile && !modssl_is_engine_id(certfile)
--        && (dhparams = ssl_dh_GetParamFromFile(certfile))) {
--        SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dhparams);
-+        && (dh = ssl_dh_GetParamFromFile(certfile))) {
-+        SSL_CTX_set_tmp_dh(mctx->ssl_ctx, dh);
-         ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, APLOGNO(02540)
-                      "Custom DH parameters (%d bits) for %s loaded from %s",
--                     DH_bits(dhparams), vhost_id, certfile);
--        DH_free(dhparams);
-+                     modssl_DH_bits(dh), vhost_id, certfile);
-+        DH_free(dh);
-     }
- 
- #ifdef HAVE_ECC
-@@ -1490,6 +1551,7 @@ static apr_status_t ssl_init_ticket_key(server_rec *s,
-     char buf[TLSEXT_TICKET_KEY_LEN];
-     char *path;
-     modssl_ticket_key_t *ticket_key = mctx->ticket_key;
-+    int res;
- 
-     if (!ticket_key->file_path) {
-         return APR_SUCCESS;
-@@ -1517,11 +1579,22 @@ static apr_status_t ssl_init_ticket_key(server_rec *s,
-     }
- 
-     memcpy(ticket_key->key_name, buf, 16);
--    memcpy(ticket_key->hmac_secret, buf + 16, 16);
-     memcpy(ticket_key->aes_key, buf + 32, 16);
--
--    if (!SSL_CTX_set_tlsext_ticket_key_cb(mctx->ssl_ctx,
--                                          ssl_callback_SessionTicket)) {
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+    memcpy(ticket_key->hmac_secret, buf + 16, 16);
-+    res = SSL_CTX_set_tlsext_ticket_key_cb(mctx->ssl_ctx,
-+                                           ssl_callback_SessionTicket);
-+#else
-+    ticket_key->mac_params[0] =
-+        OSSL_PARAM_construct_octet_string(OSSL_MAC_PARAM_KEY, buf + 16, 16);
-+    ticket_key->mac_params[1] =
-+        OSSL_PARAM_construct_utf8_string(OSSL_MAC_PARAM_DIGEST, "sha256", 0);
-+    ticket_key->mac_params[2] =
-+        OSSL_PARAM_construct_end();
-+    res = SSL_CTX_set_tlsext_ticket_key_evp_cb(mctx->ssl_ctx,
-+                                               ssl_callback_SessionTicket);
-+#endif
-+    if (!res) {
-         ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01913)
-                      "Unable to initialize TLS session ticket key callback "
-                      "(incompatible OpenSSL version?)");
-@@ -1652,7 +1725,7 @@ static apr_status_t ssl_init_proxy_certs(server_rec *s,
-         return ssl_die(s);
-     }
- 
--    X509_STORE_load_locations(store, pkp->ca_cert_file, NULL);
-+    modssl_X509_STORE_load_locations(store, pkp->ca_cert_file, NULL);
- 
-     for (n = 0; n < ncerts; n++) {
-         int i;
-@@ -2249,10 +2322,11 @@ apr_status_t ssl_init_ModuleKill(void *data)
- 
-     }
- 
--#if !MODSSL_USE_OPENSSL_PRE_1_1_API
-+#if MODSSL_USE_OPENSSL_PRE_1_1_API
-+    free_dh_params();
-+#else
-     free_bio_methods();
- #endif
--    free_dh_params();
- 
-     return APR_SUCCESS;
- }
-diff --git a/modules/ssl/ssl_engine_io.c b/modules/ssl/ssl_engine_io.c
-index cabf753790..3db7077f1e 100644
---- a/modules/ssl/ssl_engine_io.c
-+++ b/modules/ssl/ssl_engine_io.c
-@@ -194,6 +194,10 @@ static int bio_filter_destroy(BIO *bio)
- static int bio_filter_out_read(BIO *bio, char *out, int outl)
- {
-     /* this is never called */
-+    bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)BIO_get_data(bio);
-+    ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, outctx->c,
-+                  "BUG: %s() should not be called", "bio_filter_out_read");
-+    AP_DEBUG_ASSERT(0);
-     return -1;
- }
- 
-@@ -293,12 +297,20 @@ static long bio_filter_out_ctrl(BIO *bio, int cmd, long num, void *ptr)
- static int bio_filter_out_gets(BIO *bio, char *buf, int size)
- {
-     /* this is never called */
-+    bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)BIO_get_data(bio);
-+    ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, outctx->c,
-+                  "BUG: %s() should not be called", "bio_filter_out_gets");
-+    AP_DEBUG_ASSERT(0);
-     return -1;
- }
- 
- static int bio_filter_out_puts(BIO *bio, const char *str)
- {
-     /* this is never called */
-+    bio_filter_out_ctx_t *outctx = (bio_filter_out_ctx_t *)BIO_get_data(bio);
-+    ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, outctx->c,
-+                  "BUG: %s() should not be called", "bio_filter_out_puts");
-+    AP_DEBUG_ASSERT(0);
-     return -1;
- }
- 
-@@ -533,22 +545,47 @@ static int bio_filter_in_read(BIO *bio, char *in, int inlen)
- 
- static int bio_filter_in_write(BIO *bio, const char *in, int inl)
- {
-+    bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio);
-+    ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c,
-+                  "BUG: %s() should not be called", "bio_filter_in_write");
-+    AP_DEBUG_ASSERT(0);
-     return -1;
- }
- 
- static int bio_filter_in_puts(BIO *bio, const char *str)
- {
-+    bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio);
-+    ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c,
-+                  "BUG: %s() should not be called", "bio_filter_in_puts");
-+    AP_DEBUG_ASSERT(0);
-     return -1;
- }
- 
- static int bio_filter_in_gets(BIO *bio, char *buf, int size)
- {
-+    bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio);
-+    ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c,
-+                  "BUG: %s() should not be called", "bio_filter_in_gets");
-+    AP_DEBUG_ASSERT(0);
-     return -1;
- }
- 
- static long bio_filter_in_ctrl(BIO *bio, int cmd, long num, void *ptr)
- {
--    return -1;
-+    bio_filter_in_ctx_t *inctx = (bio_filter_in_ctx_t *)BIO_get_data(bio);
-+    switch (cmd) {
-+#ifdef BIO_CTRL_EOF
-+    case BIO_CTRL_EOF:
-+        return inctx->rc == APR_EOF;
-+#endif
-+    default:
-+        break;
-+    }
-+    ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, inctx->f->c,
-+                  "BUG: bio_filter_in_ctrl() should not be called with cmd=%i",
-+                  cmd);
-+    AP_DEBUG_ASSERT(0);
-+    return 0;
- }
- 
- #if MODSSL_USE_OPENSSL_PRE_1_1_API
-@@ -573,7 +610,7 @@ static BIO_METHOD bio_filter_in_method = {
-     bio_filter_in_read,
-     bio_filter_in_puts,         /* puts is never called */
-     bio_filter_in_gets,         /* gets is never called */
--    bio_filter_in_ctrl,         /* ctrl is never called */
-+    bio_filter_in_ctrl,         /* ctrl is called for EOF check */
-     bio_filter_create,
-     bio_filter_destroy,
-     NULL
-diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c
-index b99dcf19d4..aced92d2d0 100644
---- a/modules/ssl/ssl_engine_kernel.c
-+++ b/modules/ssl/ssl_engine_kernel.c
-@@ -1685,6 +1685,7 @@ const authz_provider ssl_authz_provider_verify_client =
- **  _________________________________________________________________
- */
- 
-+#if MODSSL_USE_OPENSSL_PRE_1_1_API
- /*
-  * Hand out standard DH parameters, based on the authentication strength
-  */
-@@ -1730,6 +1731,7 @@ DH *ssl_callback_TmpDH(SSL *ssl, int export, int keylen)
- 
-     return modssl_get_dh_params(keylen);
- }
-+#endif
- 
- /*
-  * This OpenSSL callback function is called when OpenSSL
-@@ -2614,7 +2616,11 @@ int ssl_callback_SessionTicket(SSL *ssl,
-                                unsigned char *keyname,
-                                unsigned char *iv,
-                                EVP_CIPHER_CTX *cipher_ctx,
--                               HMAC_CTX *hctx,
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+                               HMAC_CTX *hmac_ctx,
-+#else
-+                               EVP_MAC_CTX *mac_ctx,
-+#endif
-                                int mode)
- {
-     conn_rec *c = (conn_rec *)SSL_get_app_data(ssl);
-@@ -2641,7 +2647,13 @@ int ssl_callback_SessionTicket(SSL *ssl,
-         }
-         EVP_EncryptInit_ex(cipher_ctx, EVP_aes_128_cbc(), NULL,
-                            ticket_key->aes_key, iv);
--        HMAC_Init_ex(hctx, ticket_key->hmac_secret, 16, tlsext_tick_md(), NULL);
-+
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+        HMAC_Init_ex(hmac_ctx, ticket_key->hmac_secret, 16,
-+                     tlsext_tick_md(), NULL);
-+#else
-+        EVP_MAC_CTX_set_params(mac_ctx, ticket_key->mac_params);
-+#endif
- 
-         ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, APLOGNO(02289)
-                       "TLS session ticket key for %s successfully set, "
-@@ -2662,7 +2674,13 @@ int ssl_callback_SessionTicket(SSL *ssl,
- 
-         EVP_DecryptInit_ex(cipher_ctx, EVP_aes_128_cbc(), NULL,
-                            ticket_key->aes_key, iv);
--        HMAC_Init_ex(hctx, ticket_key->hmac_secret, 16, tlsext_tick_md(), NULL);
-+
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+        HMAC_Init_ex(hmac_ctx, ticket_key->hmac_secret, 16,
-+                     tlsext_tick_md(), NULL);
-+#else
-+        EVP_MAC_CTX_set_params(mac_ctx, ticket_key->mac_params);
-+#endif
- 
-         ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, APLOGNO(02290)
-                       "TLS session ticket key for %s successfully set, "
-diff --git a/modules/ssl/ssl_engine_log.c b/modules/ssl/ssl_engine_log.c
-index 7dbbbdb55e..3b3ceacf0a 100644
---- a/modules/ssl/ssl_engine_log.c
-+++ b/modules/ssl/ssl_engine_log.c
-@@ -78,6 +78,16 @@ apr_status_t ssl_die(server_rec *s)
-     return APR_EGENERAL;
- }
- 
-+static APR_INLINE
-+unsigned long modssl_ERR_peek_error_data(const char **data, int *flags)
-+{
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+    return ERR_peek_error_line_data(NULL, NULL, data, flags);
-+#else
-+    return ERR_peek_error_data(data, flags);
-+#endif
-+}
-+
- /*
-  * Prints the SSL library error information.
-  */
-@@ -87,7 +97,7 @@ void ssl_log_ssl_error(const char *file, int line, int level, server_rec *s)
-     const char *data;
-     int flags;
- 
--    while ((e = ERR_peek_error_line_data(NULL, NULL, &data, &flags))) {
-+    while ((e = modssl_ERR_peek_error_data(&data, &flags))) {
-         const char *annotation;
-         char err[256];
- 
-diff --git a/modules/ssl/ssl_private.h b/modules/ssl/ssl_private.h
-index a6fc7513a2..b091c58c94 100644
---- a/modules/ssl/ssl_private.h
-+++ b/modules/ssl/ssl_private.h
-@@ -89,6 +89,9 @@
- /* must be defined before including ssl.h */
- #define OPENSSL_NO_SSL_INTERN
- #endif
-+#if OPENSSL_VERSION_NUMBER >= 0x30000000
-+#include <openssl/core_names.h>
-+#endif
- #include <openssl/ssl.h>
- #include <openssl/err.h>
- #include <openssl/x509.h>
-@@ -134,13 +137,12 @@
-         SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MIN_PROTO_VERSION, version, NULL)
- #define SSL_CTX_set_max_proto_version(ctx, version) \
-         SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MAX_PROTO_VERSION, version, NULL)
--#elif LIBRESSL_VERSION_NUMBER < 0x2070000f
-+#endif /* LIBRESSL_VERSION_NUMBER < 0x2060000f */
- /* LibreSSL before 2.7 declares OPENSSL_VERSION_NUMBER == 2.0 but does not
-  * include most changes from OpenSSL >= 1.1 (new functions, macros, 
-  * deprecations, ...), so we have to work around this...
-  */
--#define MODSSL_USE_OPENSSL_PRE_1_1_API (1)
--#endif /* LIBRESSL_VERSION_NUMBER < 0x2060000f */
-+#define MODSSL_USE_OPENSSL_PRE_1_1_API (LIBRESSL_VERSION_NUMBER < 0x2070000f)
- #else /* defined(LIBRESSL_VERSION_NUMBER) */
- #define MODSSL_USE_OPENSSL_PRE_1_1_API (OPENSSL_VERSION_NUMBER < 0x10100000L)
- #endif
-@@ -674,7 +676,11 @@ typedef struct {
- typedef struct {
-     const char *file_path;
-     unsigned char key_name[16];
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
-     unsigned char hmac_secret[16];
-+#else
-+    OSSL_PARAM mac_params[3];
-+#endif
-     unsigned char aes_key[16];
- } modssl_ticket_key_t;
- #endif
-@@ -938,8 +944,16 @@ int          ssl_callback_ServerNameIndication(SSL *, int *, modssl_ctx_t *);
- int          ssl_callback_ClientHello(SSL *, int *, void *);
- #endif
- #ifdef HAVE_TLS_SESSION_TICKETS
--int         ssl_callback_SessionTicket(SSL *, unsigned char *, unsigned char *,
--                                       EVP_CIPHER_CTX *, HMAC_CTX *, int);
-+int ssl_callback_SessionTicket(SSL *ssl,
-+                               unsigned char *keyname,
-+                               unsigned char *iv,
-+                               EVP_CIPHER_CTX *cipher_ctx,
-+#if OPENSSL_VERSION_NUMBER < 0x30000000L
-+                               HMAC_CTX *hmac_ctx,
-+#else
-+                               EVP_MAC_CTX *mac_ctx,
-+#endif
-+                               int mode);
- #endif
- 
- #ifdef HAVE_TLS_ALPN
-@@ -1112,10 +1126,12 @@ void ssl_init_ocsp_certificates(server_rec *s, modssl_ctx_t *mctx);
- 
- #endif
- 
-+#if MODSSL_USE_OPENSSL_PRE_1_1_API
- /* Retrieve DH parameters for given key length.  Return value should
-  * be treated as unmutable, since it is stored in process-global
-  * memory. */
- DH *modssl_get_dh_params(unsigned keylen);
-+#endif
- 
- /* Returns non-zero if the request was made over SSL/TLS.  If sslconn
-  * is non-NULL and the request is using SSL/TLS, sets *sslconn to the

httpd-2.4.53-detect-systemd.patch

@@ -1,5 +1,5 @@
 diff --git a/Makefile.in b/Makefile.in
-index 0b088ac..9eeb5c7 100644
+index a2e9c82..bd8045c 100644
 --- a/Makefile.in
 +++ b/Makefile.in
 @@ -4,7 +4,7 @@ CLEAN_SUBDIRS = test
@@ -12,10 +12,10 @@ index 0b088ac..9eeb5c7 100644
  PROGRAM_DEPENDENCIES = \
    server/libmain.la \
 diff --git a/acinclude.m4 b/acinclude.m4
-index 2a7e5d1..eb28321 100644
+index 97484c9..05abe18 100644
 --- a/acinclude.m4
 +++ b/acinclude.m4
-@@ -624,6 +624,7 @@ case $host in
+@@ -631,6 +631,7 @@ case $host in
        if test "${ac_cv_header_systemd_sd_daemon_h}" = "no" || test -z "${SYSTEMD_LIBS}"; then
          AC_MSG_WARN([Your system does not support systemd.])
        else
@@ -24,18 +24,18 @@ index 2a7e5d1..eb28321 100644
        fi
     fi
 diff --git a/configure.in b/configure.in
-index 3618a5a..74a782b 100644
+index cf437fe..521fc45 100644
 --- a/configure.in
 +++ b/configure.in
-@@ -234,6 +234,7 @@ if test "$PCRE_CONFIG" != "false"; then
+@@ -239,6 +239,7 @@ if test "x$PCRE_CONFIG" != "x"; then
    AC_MSG_NOTICE([Using external PCRE library from $PCRE_CONFIG])
    APR_ADDTO(PCRE_INCLUDES, [`$PCRE_CONFIG --cflags`])
-   APR_ADDTO(PCRE_LIBS, [`$PCRE_CONFIG --libs`])
+   APR_ADDTO(PCRE_LIBS, [`$PCRE_CONFIG --libs8 2>/dev/null || $PCRE_CONFIG --libs`])
 +  APR_ADDTO(HTTPD_LIBS, [\$(PCRE_LIBS)])
  else
-   AC_MSG_ERROR([pcre-config for libpcre not found. PCRE is required and available from http://pcre.org/])
+   AC_MSG_ERROR([pcre(2)-config for libpcre not found. PCRE is required and available from http://pcre.org/])
  fi
-@@ -710,6 +711,7 @@ APACHE_SUBST(OS_DIR)
+@@ -734,6 +735,7 @@ APACHE_SUBST(OS_DIR)
  APACHE_SUBST(BUILTIN_LIBS)
  APACHE_SUBST(SHLIBPATH_VAR)
  APACHE_SUBST(OS_SPECIFIC_VARS)

httpd-2.4.53-export.patch

@@ -1,12 +1,5 @@
-
-Reduce size of httpd binary by telling linker to export all symbols
-from libmain.a, rather than bloating the symbol table with ap_hack_*
-to do so indirectly.
-
-Upstream: https://svn.apache.org/r1861685 (as new default-off configure option)
-
 diff --git a/Makefile.in b/Makefile.in
-index 40c7076..ac98e5f 100644
+index bd8045c..d6733a5 100644
 --- a/Makefile.in
 +++ b/Makefile.in
 @@ -4,8 +4,15 @@ CLEAN_SUBDIRS = test
@@ -40,10 +33,10 @@ index 8111877..f00bb3f 100644
  	eoc_bucket.c eor_bucket.c core_filters.c \
  	util_expr_parse.c util_expr_scan.c util_expr_eval.c
 diff --git a/server/main.c b/server/main.c
-index 62e06df..17c09ee 100644
+index 7da7aa2..e63d2eb 100644
 --- a/server/main.c
 +++ b/server/main.c
-@@ -835,17 +835,3 @@ int main(int argc, const char * const argv[])
+@@ -857,17 +857,3 @@ int main(int argc, const char * const argv[])
      return !OK;
  }
  

httpd.spec

@@ -12,7 +12,7 @@
 
 Summary: Apache HTTP Server
 Name: httpd
-Version: 2.4.51
+Version: 2.4.53
 Release: 1%{?dist}
 URL: https://httpd.apache.org/
 Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
@@ -66,16 +66,15 @@ Source48: apache-poweredby.png
 Patch2: httpd-2.4.43-apxs.patch
 Patch3: httpd-2.4.43-deplibs.patch
 # Needed for socket activation and mod_systemd patch
-Patch19: httpd-2.4.43-detect-systemd.patch
+Patch19: httpd-2.4.53-detect-systemd.patch
 # Features/functional changes
 Patch21: httpd-2.4.48-r1842929+.patch
 Patch22: httpd-2.4.43-mod_systemd.patch
-Patch23: httpd-2.4.48-export.patch
+Patch23: httpd-2.4.53-export.patch
 Patch24: httpd-2.4.43-corelimit.patch
 Patch25: httpd-2.4.43-selinux.patch
 Patch26: httpd-2.4.43-gettid.patch
 Patch27: httpd-2.4.43-icons.patch
-Patch28: httpd-2.4.48-openssl3.patch
 Patch30: httpd-2.4.43-cachehardmax.patch
 Patch34: httpd-2.4.43-socket-activation.patch
 Patch38: httpd-2.4.43-sslciphdefault.patch
@@ -228,7 +227,6 @@ written in the Lua programming language.
 %patch25 -p1 -b .selinux
 %patch26 -p1 -b .gettid
 %patch27 -p1 -b .icons
-%patch28 -p1 -b .openssl3
 %patch30 -p1 -b .cachehardmax
 %patch34 -p1 -b .socketactivation
 %patch38 -p1 -b .sslciphdefault
@@ -787,6 +785,10 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Mar 17 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.4.53-1
+- new version 2.4.53
+- fixes CVE-2022-23943, CVE-2022-22721, CVE-2022-22720 and CVE-2022-22719
+
 * Thu Oct 07 2021 Patrick Uiterwijk <patrick@puiterwijk.org> - 2.4.51-1
 - new version 2.4.51
 

sources

@@ -1,3 +1,3 @@
-SHA512 (httpd-2.4.51.tar.bz2) = 9fb07c4b176f5c0485a143e2b1bb1085345ca9120b959974f68c37a8911a57894d2cb488b1b42fdf3102860b99e890204f5e9fa7ae3828b481119c563812cc66
-SHA512 (httpd-2.4.51.tar.bz2.asc) = c63f2b08eb0b7e688c4a89b4be1d968c9e4a3f09714ffc4fb9b2210b6694b8c90f4067aec63601ec41987507bba8dfcef15f54b8c0707cc49414c9c76dd5d8ce
+SHA512 (httpd-2.4.53.tar.bz2) = 07ef59594251a30a864cc9cc9a58ab788c2d006cef85b728f29533243927c63cb063e0867f2a306f37324c3adb9cf7dcb2402f3516b05c2c6f32469d475dd756
+SHA512 (httpd-2.4.53.tar.bz2.asc) = 553df571cf8edda9146c2aaadce7e5a204f9aa8bd05b165dd81e2339db830c06bdb2b546321d3ab1dcc3133a7d37bbbeb31944b725d8a5fc6b6dc389a5c25686
 SHA512 (KEYS) = 88c848b7ab9e4915d6625dcad3e8328673b0448f2ce76f2c44eecc612cf6afbce3287a4ee7219a44c6fcc61d5ecb2a1a8545456a4a16b90400263d7249cbf192