Uploaded image for project: 'JBoss Web Server'
  1. JBoss Web Server
  2. JWS-862

Fix for CVE 2016-8743 causes MCMP to fail Host header validation check with IPv6 address

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Critical Critical
    • JWS 3.1.0 SP2 ER1
    • None
    • mod_cluster
    • None
    • Documentation (Ref Guide, User Guide, etc.)
    • The workaround for this issue is to configure the "HttpProtocolOptions" option set to "Unsafe" in httpd.conf

      This is a regression as 2.4.23-GA works.
      Reproducer:
      1. Set up httpd mod_cluster balancer with Ipv6 address with advertisement on.
      2. Set up worker node (tested with EAP)
      3. Checks on console if they correctly connect
      Issue:
      Httpd log:

      [Wed May 10 04:41:31.930288 2017] [core:debug] [pid 15638] vhost.c(796): [client 2620:52:0:105f:5054:ff:fe22:d46f:44474] AH02415: [strict] Invalid host name '2620:52:0:105f:5054:ff:fe22:d46f', problem near: :52:0:
[Wed May 10 04:41:31.930332 2017] [core:debug] [pid 15638] vhost.c(891): [client 2620:52:0:105f:5054:ff:fe22:d46f:44474] AH00550: Client sent malformed Host header: 2620:52:0:105f:5054:ff:fe22:d46f:8747
[Wed May 10 04:41:31.930338 2017] [core:debug] [pid 15638] protocol.c(1385): [client 2620:52:0:105f:5054:ff:fe22:d46f:44474] AH00569: client sent HTTP/1.1 request without hostname (see RFC2616 section 14.23): /

      EAP6(6.4.10) log:

      04:41:29,316 ERROR [org.jboss.modcluster] (ContainerBackgroundProcessor[StandardEngine[jboss.web]]) MODCLUSTER000042: Error null sending INFO command to 2620:52:0:105f:5054:ff:fe22:d46f/2620:52:0:105f:5054:ff:fe22:d46f:8747, configuration will be reset: null

      Tomcat log:

      May 10, 2017 9:05:25 AM org.jboss.modcluster.mcmp.impl.DefaultMCMPHandler sendRequest
ERROR: MODCLUSTER000042: Error null sending INFO command to 2620:52:0:105f:5054:ff:fe22:d46f/2620:52:0:105f:5054:ff:fe22:d46f:8747, configuration will be reset: null

      Issue was reproduced with EAP-7.1.0.DR17 too. Httpd-2.4.23-GA don't have this issue.
      Issue has some connection to ipv6 as some ipv6 tests passed.
      Failed on:
      2620:52:0:105f:5054:ff:fe22:d46f, 2620:52:0:105f:5054:ff:fe0c:5717, 2620:52:0:105f:5054:ff:feb5:a642, ...
      Passed on:
      2620:52:0:1040:e8f4:2bff:feef:e504, 2620:52:0:1040:440c:3ff:fee1:df02, ...

              gzaronik@redhat.com George Zaronikas
              bsikora Bogdan Sikora (Inactive)
              Karm Karm Karm Karm
              Votes:
              0 Vote for this issue
              Watchers:
              9 Start watching this issue

                Created:
                Updated:
                Resolved: