shadowdaoandClaude Sonnet 5.5
541c565947
mod_http2 (httpd 2.4.55-2.4.70) assign_headers() heap corruption -> RCE; AlmaLinux has no fixed httpd yet. Nothing in WHP uses HTTP/2 inside a container (HAProxy edge terminates h2/h3 and speaks HTTP/1.1 to backends), so uninstall mod_http2 (and mod_md if ever present) from cac, cac-fpm and shared-httpd. scripts/httpd-h2-md-gate.sh fails the build if http2_module, proxy_http2_module or md_module is loadable or `httpd -t` fails, writes /etc/whp-httpd-version and the images get LABEL org.whp.httpd-h2-md=removed. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0185ukXjXyosSkunDsdWz3mb
56 lines
2.2 KiB
Bash
Executable File
56 lines
2.2 KiB
Bash
Executable File
#!/bin/bash
|
|
# CVE-2026-119618 (mod_http2 assign_headers heap corruption, httpd 2.4.55-2.4.70)
|
|
# defense in depth. Nothing in WHP needs HTTP/2 or mod_md inside a container: the
|
|
# HAProxy edge terminates h2/h3 and speaks HTTP/1.1 to backends, and certificates
|
|
# come from the edge, not mod_md. So the modules are removed from every
|
|
# Alma-based Apache image and this gate fails the build if they ever come back.
|
|
#
|
|
# httpd-h2-md-gate.sh remove uninstall mod_http2 / mod_md RPMs (if present)
|
|
# httpd-h2-md-gate.sh check fail unless the modules cannot load, `httpd -t`
|
|
# passes, and record the httpd version
|
|
#
|
|
# Both are idempotent and safe on images with no Apache at all (a no-op).
|
|
set -euo pipefail
|
|
|
|
BAD_MODULES='http2_module|proxy_http2_module|md_module'
|
|
MOD_PKGS='mod_http2 mod_md'
|
|
|
|
cmd_remove() {
|
|
local p present=()
|
|
for p in $MOD_PKGS; do
|
|
rpm -q "$p" >/dev/null 2>&1 && present+=("$p")
|
|
done
|
|
if [ "${#present[@]}" -gt 0 ]; then
|
|
dnf remove -y "${present[@]}"
|
|
fi
|
|
# Belt and braces if a package was removed but a module file was left behind.
|
|
rm -f /etc/httpd/conf.modules.d/10-h2.conf /etc/httpd/conf.modules.d/10-proxy_h2.conf \
|
|
/etc/httpd/conf.modules.d/*-md.conf \
|
|
/usr/lib64/httpd/modules/mod_http2.so /usr/lib64/httpd/modules/mod_proxy_http2.so \
|
|
/usr/lib64/httpd/modules/mod_md.so
|
|
}
|
|
|
|
cmd_check() {
|
|
local p mods v fail=0
|
|
command -v httpd >/dev/null 2>&1 || { echo "gate: no httpd binary" >&2; exit 1; }
|
|
for p in $MOD_PKGS; do
|
|
if rpm -q "$p" >/dev/null 2>&1; then echo "gate FAIL: RPM $p is installed" >&2; fail=1; fi
|
|
done
|
|
# Anchored on the module name column ("systemd_module" must NOT match md_module).
|
|
mods=$(httpd -M 2>/dev/null) || { echo "gate FAIL: httpd -M failed" >&2; exit 1; }
|
|
if printf '%s\n' "$mods" | grep -E "^ (${BAD_MODULES}) "; then
|
|
echo "gate FAIL: HTTP/2 or mod_md module still loadable" >&2; fail=1
|
|
fi
|
|
[ "$fail" -eq 0 ] || exit 1
|
|
httpd -t
|
|
v=$(rpm -q --qf '%{VERSION}-%{RELEASE}' httpd-core)
|
|
printf '%s\n' "$v" > /etc/whp-httpd-version
|
|
echo "gate OK: httpd-core ${v}; no http2/proxy_http2/md modules; httpd -t passes"
|
|
}
|
|
|
|
case "${1:-}" in
|
|
remove) cmd_remove ;;
|
|
check) cmd_check ;;
|
|
*) echo "usage: $0 remove|check" >&2; exit 2 ;;
|
|
esac
|