diff --git a/.gitignore b/.gitignore
index 260a2d6..9969f1d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1 @@
SOURCES/httpd-2.4.6.tar.bz2
-SOURCES/centos-noindex.tar.gz
diff --git a/.httpd.metadata b/.httpd.metadata
index 17ede1b..d335a99 100644
--- a/.httpd.metadata
+++ b/.httpd.metadata
@@ -1,2 +1 @@
16d8ec72535ded65d035122b0d944b0e64eaa2a2 SOURCES/httpd-2.4.6.tar.bz2
-6ce5ab3c765b9efeceb2e636e32373bc6e6ed489 SOURCES/centos-noindex.tar.gz
diff --git a/README.debrand b/README.debrand
deleted file mode 100644
index 01c46d2..0000000
--- a/README.debrand
+++ /dev/null
@@ -1,2 +0,0 @@
-Warning: This package was configured for automatic debranding, but the changes
-failed to apply.
diff --git a/SOURCES/httpd-2.4.6-CVE-2023-25690.patch b/SOURCES/httpd-2.4.6-CVE-2023-25690.patch
index db8498b..932cafd 100644
--- a/SOURCES/httpd-2.4.6-CVE-2023-25690.patch
+++ b/SOURCES/httpd-2.4.6-CVE-2023-25690.patch
@@ -1,5 +1,5 @@
diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
-index b89d3e4..19f70d1 100644
+index b89d3e4..0103d37 100644
--- a/modules/mappers/mod_rewrite.c
+++ b/modules/mappers/mod_rewrite.c
@@ -166,6 +166,7 @@ static const char* really_last_key = "rewrite_really_last";
@@ -84,13 +84,14 @@ index b89d3e4..19f70d1 100644
return apr_pstrcat(cmd->pool, "RewriteRule: bad argument line '", str,
"'", NULL);
}
-@@ -3705,6 +3718,16 @@ static const char *cmd_rewriterule(cmd_parms *cmd, void *in_dconf,
+@@ -3705,6 +3718,17 @@ static const char *cmd_rewriterule(cmd_parms *cmd, void *in_dconf,
newrule->flags |= RULEFLAG_NOSUB;
}
+ if (*(a2_end-1) == '?') {
+ /* a literal ? at the end of the unsubstituted rewrite rule */
+ newrule->flags |= RULEFLAG_QSNONE;
++ *(a2_end-1) = '\0'; /* trailing ? has done its job */
+ }
+ else if (newrule->flags & RULEFLAG_QSDISCARD) {
+ if (NULL == ap_strchr(newrule->output, '?')) {
@@ -101,7 +102,7 @@ index b89d3e4..19f70d1 100644
/* now, if the server or per-dir config holds an
* array of RewriteCond entries, we take it for us
* and clear the array
-@@ -4110,7 +4133,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
+@@ -4110,7 +4134,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
r->path_info = NULL;
}
@@ -110,7 +111,7 @@ index b89d3e4..19f70d1 100644
/* Add the previously stripped per-directory location prefix, unless
* (1) it's an absolute URL path and
-@@ -4565,6 +4588,17 @@ static int hook_uri2file(request_rec *r)
+@@ -4565,6 +4589,17 @@ static int hook_uri2file(request_rec *r)
unsigned skip;
apr_size_t flen;
@@ -128,7 +129,7 @@ index b89d3e4..19f70d1 100644
if (ACTION_STATUS == rulestatus) {
int n = r->status;
-@@ -4833,6 +4867,17 @@ static int hook_fixup(request_rec *r)
+@@ -4833,6 +4868,17 @@ static int hook_fixup(request_rec *r)
if (rulestatus) {
unsigned skip;
diff --git a/SOURCES/welcome.conf b/SOURCES/welcome.conf
index c1b6c11..5d1e452 100644
--- a/SOURCES/welcome.conf
+++ b/SOURCES/welcome.conf
@@ -16,7 +16,3 @@
</Directory>
Alias /.noindex.html /usr/share/httpd/noindex/index.html
-Alias /noindex/css/bootstrap.min.css /usr/share/httpd/noindex/css/bootstrap.min.css
-Alias /noindex/css/open-sans.css /usr/share/httpd/noindex/css/open-sans.css
-Alias /images/apache_pb.gif /usr/share/httpd/noindex/images/apache_pb.gif
-Alias /images/poweredby.png /usr/share/httpd/noindex/images/poweredby.png
diff --git a/SPECS/httpd.spec b/SPECS/httpd.spec
index b7d74b0..f95830d 100644
--- a/SPECS/httpd.spec
+++ b/SPECS/httpd.spec
@@ -5,7 +5,6 @@
%define oldmmnisa %{mmn}-%{__isa_name}-%{__isa_bits}
%define mmnisa %{mmn}%{__isa_name}%{__isa_bits}
%define vstring %(source /etc/os-release; echo ${REDHAT_SUPPORT_PRODUCT})
-%define vstring CentOS
# Drop automatic provides for module DSOs
%{?filter_setup:
@@ -16,10 +15,10 @@
Summary: Apache HTTP Server
Name: httpd
Version: 2.4.6
-Release: 98%{?dist}.7
+Release: 99%{?dist}.1
URL: http://httpd.apache.org/
Source0: http://www.apache.org/dist/httpd/httpd-%{version}.tar.bz2
-Source1: centos-noindex.tar.gz
+Source1: index.html
Source2: httpd.logrotate
Source3: httpd.sysconf
Source4: httpd-ssl-pass-dialog
@@ -681,9 +680,6 @@ mkdir $RPM_BUILD_ROOT%{contentdir}/noindex
install -m 644 -p $RPM_SOURCE_DIR/index.html \
$RPM_BUILD_ROOT%{contentdir}/noindex/index.html
rm -rf %{contentdir}/htdocs
-tar xzf $RPM_SOURCE_DIR/centos-noindex.tar.gz \
- -C $RPM_BUILD_ROOT%{contentdir}/noindex/ \
- --strip-components=1
# remove manual sources
find $RPM_BUILD_ROOT%{contentdir}/manual \( \
@@ -891,7 +887,7 @@ rm -rf $RPM_BUILD_ROOT
%{contentdir}/error/README
%{contentdir}/error/*.var
%{contentdir}/error/include/*.html
-%{contentdir}/noindex/*
+%{contentdir}/noindex/index.html
%dir %{docroot}
%dir %{docroot}/cgi-bin
@@ -957,8 +953,8 @@ rm -rf $RPM_BUILD_ROOT
%{_sysconfdir}/rpm/macros.httpd
%changelog
-* Wed Apr 5 2023 Johnny Hughes <johnny@centos.org>
-- Manual CentOS Debranding
+* Thu Apr 27 2023 Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-99.1
+- Resolves: #2190143 - mod_rewrite regression with CVE-2023-25690
* Tue Mar 21 2023 Luboš Uhliarik <luhliari@redhat.com> - 2.4.6-97.7
- Resolves: #2177742 - CVE-2023-25690 httpd: HTTP request splitting with