Loading...

XML

Word

Printable

Affects:

Release Notes
CDW devel_ack:
CDW docs_ack:
CDW pm_ack:
CDW qa_ack:
CDW release:
Target Release:

httpd 2.4.23 SP3 GA
Steps to Reproduce:

Hide

Append to httpd.conf

Session On
SessionEnv On
SessionCookieName session path=/

SessionHeader X-Replace-Session
SessionCryptoPassphrase PavelIsTheVeryBest
LoadModule session_module modules/mod_session.so
LoadModule session_crypto_module modules/mod_session_crypto.so
LoadModule session_cookie_module modules/mod_session_cookie.so

Place oracle.bat to cgi-bin directory
'cat oracle.bat'
@echo off
set ORIG_COOKIE=motto=This is the end, beautiful friend. This is the end, my only friend, the end.
echo Content-type: text/plain
echo X-Replace-Session: ["%ORIG_COOKIE%"]
echo.

echo hello %ORIG_COOKIE%

call 'curl localhost/cgi-bin/oracle.bat -i'

Show
Append to httpd.conf Session On SessionEnv On SessionCookieName session path=/ SessionHeader X-Replace-Session SessionCryptoPassphrase PavelIsTheVeryBest LoadModule session_module modules/mod_session.so LoadModule session_crypto_module modules/mod_session_crypto.so LoadModule session_cookie_module modules/mod_session_cookie.so Place oracle.bat to cgi-bin directory 'cat oracle.bat' @echo off set ORIG_COOKIE=motto=This is the end, beautiful friend. This is the end, my only friend, the end. echo Content-type: text/plain echo X-Replace-Session: ["%ORIG_COOKIE%"] echo. echo hello %ORIG_COOKIE% call 'curl localhost/cgi-bin/oracle.bat -i'

httpd 2.4.23-SP1-DR2 crashes when mod_session_crypto is used. However, when apache from http://www.apachehaus.com is used no crashes are observed.

Also when line SessionCryptoPassphrase PavelIsTheVeryBest from conf. file is commented no crashes are observed.

I didn't notice anything relevant in logs, it just seems to me that servers restarts itself.

is caused by

JBCS-352 apr_crypto_openssl is missing in zips for windows

is related to

JBCS-351 Dereferencing NULL pointer