Mailing-List: contact bugs-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Apache HTTPD Bugs Notification List" <bugs@httpd.apache.org>
From: bugzilla@apache.org
To: bugs@httpd.apache.org
Subject: [Bug 57832] Reduction of response splitting attacks consequences in
 mod_proxy
Date: Mon, 18 May 2015 09:03:11 +0000
Message-ID: <bug-57832-7868-8R56ZqKb8G@https.bz.apache.org/bugzilla/>
In-Reply-To: <bug-57832-7868@https.bz.apache.org/bugzilla/>
References: <bug-57832-7868@https.bz.apache.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
Auto-Submitted: auto-generated
MIME-Version: 1.0

https://bz.apache.org/bugzilla/show_bug.cgi?id=57832

--- Comment #9 from regilero <regis.leroy@makina-corpus.com> ---
This version is OK.

Stored injections are always detected, small and big.
The only way to inject a new response is to have a fine control of the backend
stream and use timers between responses, which ,by definition, cannot be
detected by mod_proxy.

So it's almost good. I think there's maybe just one problem with responses from
backends containing one extra CRLF. This is already managed by mod_proxy and
allowed by the RFC. But here, if I'm not wrong on my tests, it makes a
connection status 2.

-- 
You are receiving this mail because:
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org