[Bug 1226217] Regression of security fix: Apache ignores headers sent by CGI scripts
![](https://seccdn.libravatar.org/avatar/a895f78a81a109471893519443e4d933.jpg?s=120&d=mm&r=g)
https://bugzilla.suse.com/show_bug.cgi?id=1226217
https://bugzilla.suse.com/show_bug.cgi?id=1226217#c7
--- Comment #7 from Dirk Stoecker
GET /cgi-bin/error.cgi HTTP/1.1 User-Agent: curl/8.8.0 Accept: */*
* Request completely sent off < HTTP/1.1 200 OK < Date: Thu, 13 Jun 2024 08:53:37 GMT < Server: Apache < Transfer-Encoding: chunked < Content-Type: application/x-cgi < 3 --- 0 --- in tcpdump the double encoding is visible better: MHTTP/1.1 200 OK Date: Thu, 13 Jun 2024 08:45:23 GMT Server: Apache Transfer-Encoding: chunked Content-Type: application/x-cgi 8 3 --- 0 Ok:
GET /cgi-bin/error.cgi HTTP/1.1 User-Agent: curl/8.8.0 Accept: */*
* Request completely sent off < HTTP/1.1 200 OK < Date: Thu, 13 Jun 2024 08:54:09 GMT < Server: Apache < Transfer-Encoding: chunked < Content-Length: 3 < Content-Type: application/x-cgi < * Connection #0 to host a07upload.gnssonline.eu left intact --- It SHOULD send content length header and not do transfer encoding different to the script (i.e. when script has no transfer encoding, the output also shouldn't - not tested in this example). -- You are receiving this mail because: You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply@suse.com