Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: neutral (athena.apache.org: local policy)
Date: Thu, 1 Sep 2011 15:35:36 +0100
From: Nick Kew <nick@webthing.com>
To: dev@httpd.apache.org
Subject: Re: RequestHeader early with CVE-2011-3192
Message-ID: <20110901153536.0a836fe3@baldur>
In-Reply-To: 
 <7F9A6D26EB51614FBF9F81C0DA4CFEC8024A9D51853C@il-ex01.ad.checkpoint.com>
References: 
 <7F9A6D26EB51614FBF9F81C0DA4CFEC8024A9D51853C@il-ex01.ad.checkpoint.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

On Thu, 1 Sep 2011 16:58:07 +0300
Yehezkel Horowitz <horowity@checkpoint.com> wrote:

> Hello
> 
> In case I don't want to support "Range" and "Request-Range" headers at all, would it be safe to remove those headers in the early processing hook?
> 
> Something like:
> RequestHeader unset Range early
> RequestHeader unset Range-Request early
> 
> I'm asking because the documentation of mod_headers recommends not using the early mode in an operational server.

This would be on-topic for the users list rather than here.

The reason for that recommendation is that when used 'early' it will
have side-effects, like ignoring the context it's supposed to be
configured for.

If you want the unset to apply server-wide, then early should be fine.


-- 
Nick Kew