fix CVE-2022-28330

backport-CVE-2022-28330.patch

@@ -0,0 +1,32 @@
+From 258698607821acfda8f90d9d17e44d18c30f8d77 Mon Sep 17 00:00:00 2001
+From: covener <covener@apache.org>
+Date: Wed, 1 Jun 2022 12:37:44 UTC
+Subject: [PATCH] mod_isapi:use consistent filename
+
+Conflict:NA
+Reference:https://github.com/apache/httpd/commit/258698607821acfda8f90d9d17e44d18c30f8d77
+---
+ modules/arch/win32/mod_isapi.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/modules/arch/win32/mod_isapi.c b/modules/arch/win32/mod_isapi.c
+index 23e6a68..724d529 100644
+--- a/modules/arch/win32/mod_isapi.c
++++ b/modules/arch/win32/mod_isapi.c
+@@ -976,11 +976,11 @@ static int APR_THREAD_FUNC regfnServerSupportFunction(isapi_cid    *cid,
+             return 0;
+         }
+ 
+-        len = (apr_uint32_t)strlen(r->filename);
++        len = (apr_uint32_t)strlen(subreq->filename);
+ 
+         if ((subreq->finfo.filetype == APR_DIR)
+               && (!subreq->path_info)
+-              && (file[len - 1] != '/'))
++              && (subreq->filename[len - 1] != '/'))
+             file = apr_pstrcat(cid->r->pool, subreq->filename, "/", NULL);
+         else
+             file = apr_pstrcat(cid->r->pool, subreq->filename,
+-- 
+2.23.0
+

httpd.spec

@@ -8,7 +8,7 @@
 Name:             httpd
 Summary:          Apache HTTP Server
 Version:          2.4.43
-Release:          16
+Release:          17
 License:          ASL 2.0
 URL:              https://httpd.apache.org/
 Source0:          https://archive.apache.org/dist/httpd/httpd-%{version}.tar.bz2
@@ -99,6 +99,7 @@ Patch45:          backport-CVE-2022-26377.patch
 Patch46:          backport-CVE-2022-30522.patch
 Patch47:          backport-CVE-2022-28615.patch
 Patch48:          backport-CVE-2022-31813.patch
+Patch49:          backport-CVE-2022-28330.patch
 
 BuildRequires:    gcc autoconf pkgconfig findutils xmlto perl-interpreter perl-generators systemd-devel
 BuildRequires:    zlib-devel libselinux-devel lua-devel brotli-devel
@@ -535,6 +536,12 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Thu Jul 21 2022 chengyechun <chengyechun1@huawei.com> - 2.4.43-17
+- Type:CVE
+- ID:CVE-2022-28330
+- SUG:restart 
+- DESC:fix CVE-2022-28330
+
 * Tue Jun 21 2022 chenzhitao <chenzhitao8@huawei.com> - 2.4.43-16
 - Type:CVE
 - ID:NA