diff --git a/README.debrand b/README.debrand
deleted file mode 100644
index 01c46d2..0000000
--- a/README.debrand
+++ /dev/null
@@ -1,2 +0,0 @@
-Warning: This package was configured for automatic debranding, but the changes
-failed to apply.
diff --git a/SOURCES/httpd-2.4.53-CVE-2006-20001.patch b/SOURCES/httpd-2.4.53-CVE-2006-20001.patch
new file mode 100644
index 0000000..26c9363
--- /dev/null
+++ b/SOURCES/httpd-2.4.53-CVE-2006-20001.patch
@@ -0,0 +1,20 @@
+diff --git a/modules/dav/main/util.c b/modules/dav/main/util.c
+index 1ae5914027c..3f7822fc931 100644
+--- a/modules/dav/main/util.c
++++ b/modules/dav/main/util.c
+@@ -801,8 +801,14 @@ static dav_error * dav_process_if_header(request_rec *r, dav_if_header **p_ih)
+ "for the same state.");
+ }
+ condition = DAV_IF_COND_NOT;
++ list += 2;
++ }
++ else {
++ return dav_new_error(r->pool, HTTP_BAD_REQUEST,
++ DAV_ERR_IF_UNK_CHAR, 0,
++ "Invalid \"If:\" header: "
++ "Unexpected character in List");
+ }
+- list += 2;
+ break;
+
+ case ' ':
diff --git a/SOURCES/httpd-2.4.53-CVE-2022-36760.patch b/SOURCES/httpd-2.4.53-CVE-2022-36760.patch
new file mode 100644
index 0000000..5a34c30
--- /dev/null
+++ b/SOURCES/httpd-2.4.53-CVE-2022-36760.patch
@@ -0,0 +1,23 @@
+From 5efc9507c487c37dfe2a279a4a0335cad701cd5f Mon Sep 17 00:00:00 2001
+From: Eric Covener <covener@apache.org>
+Date: Tue, 10 Jan 2023 13:19:07 +0000
+Subject: [PATCH] cleanup on error
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1906540 13f79535-47bb-0310-9956-ffa450edef68
+---
+ modules/proxy/mod_proxy_ajp.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/modules/proxy/mod_proxy_ajp.c b/modules/proxy/mod_proxy_ajp.c
+index 9cd7adbcbbf..07f37392d88 100644
+--- a/modules/proxy/mod_proxy_ajp.c
++++ b/modules/proxy/mod_proxy_ajp.c
+@@ -255,6 +255,8 @@ static int ap_proxy_ajp_request(apr_pool_t *p, request_rec *r,
+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10396)
+ "%s Transfer-Encoding is not supported",
+ tenc);
++ /* We had a failure: Close connection to backend */
++ conn->close = 1;
+ return HTTP_INTERNAL_SERVER_ERROR;
+ }
+ } else {
diff --git a/SOURCES/httpd-2.4.53-CVE-2022-37436.patch b/SOURCES/httpd-2.4.53-CVE-2022-37436.patch
new file mode 100644
index 0000000..26311e8
--- /dev/null
+++ b/SOURCES/httpd-2.4.53-CVE-2022-37436.patch
@@ -0,0 +1,129 @@
+From 8b6d55f6a047acf62675e32606b037f5eea8ccc7 Mon Sep 17 00:00:00 2001
+From: Eric Covener <covener@apache.org>
+Date: Tue, 10 Jan 2023 13:20:09 +0000
+Subject: [PATCH] Merge r1906539 from trunk:
+
+fail on bad header
+
+Submitted By: covener
+Reviewed By: covener, rpluem, gbechis
+
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1906541 13f79535-47bb-0310-9956-ffa450edef68
+---
+ modules/proxy/mod_proxy_http.c | 46 ++++++++++++++++++++--------------
+ server/protocol.c | 2 ++
+ 2 files changed, 29 insertions(+), 19 deletions(-)
+
+diff --git a/modules/proxy/mod_proxy_http.c b/modules/proxy/mod_proxy_http.c
+index d74ae054ac9..ec4e7fb06b5 100644
+--- a/modules/proxy/mod_proxy_http.c
++++ b/modules/proxy/mod_proxy_http.c
+@@ -788,7 +788,7 @@ static void process_proxy_header(request_rec *r, proxy_dir_conf *c,
+ * any sense at all, since we depend on buffer still containing
+ * what was read by ap_getline() upon return.
+ */
+-static void ap_proxy_read_headers(request_rec *r, request_rec *rr,
++static apr_status_t ap_proxy_read_headers(request_rec *r, request_rec *rr,
+ char *buffer, int size,
+ conn_rec *c, int *pread_len)
+ {
+@@ -820,19 +820,26 @@ static void ap_proxy_read_headers(request_rec *r, request_rec *rr,
+ rc = ap_proxygetline(tmp_bb, buffer, size, rr,
+ AP_GETLINE_FOLD | AP_GETLINE_NOSPC_EOL, &len);
+
+- if (len <= 0)
+- break;
+
+- if (APR_STATUS_IS_ENOSPC(rc)) {
+- /* The header could not fit in the provided buffer, warn.
+- * XXX: falls through with the truncated header, 5xx instead?
+- */
+- int trunc = (len > 128 ? 128 : len) / 2;
+- ap_log_rerror(APLOG_MARK, APLOG_WARNING, rc, r, APLOGNO(10124)
+- "header size is over the limit allowed by "
+- "ResponseFieldSize (%d bytes). "
+- "Bad response header: '%.*s[...]%s'",
+- size, trunc, buffer, buffer + len - trunc);
++ if (rc != APR_SUCCESS) {
++ if (APR_STATUS_IS_ENOSPC(rc)) {
++ int trunc = (len > 128 ? 128 : len) / 2;
++ ap_log_rerror(APLOG_MARK, APLOG_WARNING, rc, r, APLOGNO(10124)
++ "header size is over the limit allowed by "
++ "ResponseFieldSize (%d bytes). "
++ "Bad response header: '%.*s[...]%s'",
++ size, trunc, buffer, buffer + len - trunc);
++ }
++ else {
++ ap_log_rerror(APLOG_MARK, APLOG_WARNING, rc, r, APLOGNO(10404)
++ "Error reading headers from backend");
++ }
++ r->headers_out = NULL;
++ return rc;
++ }
++
++ if (len <= 0) {
++ break;
+ }
+ else {
+ ap_log_rerror(APLOG_MARK, APLOG_TRACE4, 0, r, "%s", buffer);
+@@ -855,7 +862,7 @@ static void ap_proxy_read_headers(request_rec *r, request_rec *rr,
+ if (psc->badopt == bad_error) {
+ /* Nope, it wasn't even an extra HTTP header. Give up. */
+ r->headers_out = NULL;
+- return;
++ return APR_EINVAL;
+ }
+ else if (psc->badopt == bad_body) {
+ /* if we've already started loading headers_out, then
+@@ -869,13 +876,13 @@ static void ap_proxy_read_headers(request_rec *r, request_rec *rr,
+ "in headers returned by %s (%s)",
+ r->uri, r->method);
+ *pread_len = len;
+- return;
++ return APR_SUCCESS;
+ }
+ else {
+ ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, APLOGNO(01099)
+ "No HTTP headers returned by %s (%s)",
+ r->uri, r->method);
+- return;
++ return APR_SUCCESS;
+ }
+ }
+ }
+@@ -905,6 +912,7 @@ static void ap_proxy_read_headers(request_rec *r, request_rec *rr,
+ process_proxy_header(r, dconf, buffer, value);
+ saw_headers = 1;
+ }
++ return APR_SUCCESS;
+ }
+
+
+@@ -1218,10 +1226,10 @@ int ap_proxy_http_process_response(proxy_http_req_t *req)
+ "Set-Cookie", NULL);
+
+ /* shove the headers direct into r->headers_out */
+- ap_proxy_read_headers(r, backend->r, buffer, response_field_size,
+- origin, &pread_len);
++ rc = ap_proxy_read_headers(r, backend->r, buffer, response_field_size,
++ origin, &pread_len);
+
+- if (r->headers_out == NULL) {
++ if (rc != APR_SUCCESS || r->headers_out == NULL) {
+ ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, APLOGNO(01106)
+ "bad HTTP/%d.%d header returned by %s (%s)",
+ major, minor, r->uri, r->method);
+diff --git a/server/protocol.c b/server/protocol.c
+index 7adc7f75c10..6f9540ad1de 100644
+--- a/server/protocol.c
++++ b/server/protocol.c
+@@ -508,6 +508,8 @@ AP_DECLARE(apr_status_t) ap_rgetline_core(char **s, apr_size_t n,
+ /* PR#43039: We shouldn't accept NULL bytes within the line */
+ bytes_handled = strlen(*s);
+ if (bytes_handled < *read) {
++ ap_log_data(APLOG_MARK, APLOG_DEBUG, ap_server_conf,
++ "NULL bytes in header", *s, *read, 0);
+ *read = bytes_handled;
+ if (rv == APR_SUCCESS) {
+ rv = APR_EINVAL;
diff --git a/SOURCES/httpd-init.service b/SOURCES/httpd-init.service
index 3074778..704c314 100644
--- a/SOURCES/httpd-init.service
+++ b/SOURCES/httpd-init.service
@@ -8,5 +8,6 @@ ConditionPathExists=|!/etc/pki/tls/private/localhost.key
[Service]
Type=oneshot
RemainAfterExit=no
+PrivateTmp=true
ExecStart=/usr/libexec/httpd-ssl-gencerts
diff --git a/SOURCES/httpd-ssl-gencerts b/SOURCES/httpd-ssl-gencerts
index 350f5b5..5c271f7 100755
--- a/SOURCES/httpd-ssl-gencerts
+++ b/SOURCES/httpd-ssl-gencerts
@@ -33,6 +33,7 @@ sscg -q \
--cert-file /etc/pki/tls/certs/localhost.crt \
--cert-key-file /etc/pki/tls/private/localhost.key \
--ca-file /etc/pki/tls/certs/localhost.crt \
+ --dhparams-file /tmp/dhparams.pem \
--lifetime 365 \
--hostname $FQDN \
--email root@$FQDN
diff --git a/SPECS/httpd.spec b/SPECS/httpd.spec
index 1e0e486..1831235 100644
--- a/SPECS/httpd.spec
+++ b/SPECS/httpd.spec
@@ -13,7 +13,7 @@
Summary: Apache HTTP Server
Name: httpd
Version: 2.4.53
-Release: 7%{?dist}
+Release: 7%{?dist}.1
URL: https://httpd.apache.org/
Source0: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
Source1: https://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2.asc
@@ -130,6 +130,12 @@ Patch204: httpd-2.4.53-CVE-2022-29404.patch
Patch205: httpd-2.4.53-CVE-2022-30522.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=2095018
Patch206: httpd-2.4.53-CVE-2022-30556.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2161773
+Patch207: httpd-2.4.53-CVE-2022-37436.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2161774
+Patch208: httpd-2.4.53-CVE-2006-20001.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2161777
+Patch209: httpd-2.4.53-CVE-2022-36760.patch
License: ASL 2.0
BuildRequires: gcc, autoconf, pkgconfig, findutils, xmlto
@@ -304,6 +310,9 @@ written in the Lua programming language.
%patch204 -p1 -b .CVE-2022-29404
%patch205 -p1 -b .CVE-2022-30522
%patch206 -p1 -b .CVE-2022-30556
+%patch207 -p1 -b .CVE-2022-37436
+%patch208 -p1 -b .CVE-2006-20001
+%patch209 -p1 -b .CVE-2022-36760
# Patch in the vendor string
sed -i '/^#define PLATFORM/s/Unix/%{vstring}/' os/unix/os.h
@@ -863,6 +872,14 @@ exit $rv
%{_rpmconfigdir}/macros.d/macros.httpd
%changelog
+* Tue Jan 31 2023 Luboš Uhliarik <luhliari@redhat.com> - 2.4.53-7.1
+- Resolves: #2165975 - prevent sscg creating /dhparams.pem
+- Resolves: #2165970 - CVE-2006-20001 httpd: mod_dav: out-of-bounds read/write
+ of zero byte
+- Resolves: #2165973 - CVE-2022-37436 httpd: mod_proxy: HTTP response splitting
+- Resolves: #2165974 - CVE-2022-36760 httpd: mod_proxy_ajp: Possible request
+ smuggling
+
* Wed Jul 20 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.4.53-7
- Resolves: #2094997 - CVE-2022-26377 httpd: mod_proxy_ajp: Possible request
smuggling