fix CVE-2021-26691

CVE-2021-26691.patch

@@ -0,0 +1,31 @@
+From 7e09dd714fc62c08c5b0319ed7b9702594faf49b Mon Sep 17 00:00:00 2001
+From: Yann Ylavic <ylavic@apache.org>
+Date: Mon, 1 Mar 2021 20:13:54 +0000
+Subject: [PATCH] mod_session: account for the '&' in identity_concat().
+
+git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1887052 13f79535-47bb-0310-9956-ffa450edef68
+---
+ modules/session/mod_session.c       | 3 +--
+ 1 files changed, 1 insertions(+), 2 deletions(-)
+
+diff --git a/modules/session/mod_session.c b/modules/session/mod_session.c
+index 01f41fe5d0f..a41e58444f9 100644
+--- a/modules/session/mod_session.c
++++ b/modules/session/mod_session.c
+@@ -326,7 +326,7 @@ static apr_status_t ap_session_set(request_rec * r, session_rec * z,
+ static int identity_count(void *v, const char *key, const char *val)
+ {
+     int *count = v;
+-    *count += strlen(key) * 3 + strlen(val) * 3 + 1;
++    *count += strlen(key) * 3 + strlen(val) * 3 + 2;
+     return 1;
+ }
+ 
+@@ -362,7 +362,6 @@ static int identity_concat(void *v, const char *key, const char *val)
+  */
+ static apr_status_t session_identity_encode(request_rec * r, session_rec * z)
+ {
+-
+     char *buffer = NULL;
+     int length = 0;
+     if (z->expiry) {

httpd.spec

@@ -8,7 +8,7 @@
 Name:             httpd
 Summary:          Apache HTTP Server
 Version:          2.4.46
-Release:          1
+Release:          2
 License:          ASL 2.0
 URL:              https://httpd.apache.org/
 Source0:          https://archive.apache.org/dist/httpd/httpd-%{version}.tar.bz2
@@ -70,6 +70,7 @@ Patch16:          httpd-2.4.43-gettid.patch
 Patch17:          httpd-2.4.43-r1861793+.patch
 Patch18:          httpd-2.4.43-r1828172+.patch 
 Patch19:          httpd-2.4.46-htcacheclean-dont-break.patch 
+Patch20:          CVE-2021-26691.patch 
 
 BuildRequires:    gcc autoconf pkgconfig findutils xmlto perl-interpreter perl-generators systemd-devel
 BuildRequires:    zlib-devel libselinux-devel lua-devel brotli-devel
@@ -502,6 +503,12 @@ exit $rv
 %{_rpmconfigdir}/macros.d/macros.httpd
 
 %changelog
+* Wed Jun 16 2021 yanglu <yanglu72@huawei.com> - 2.4.46-2
+- Type:cves
+- ID:CVE-2021-26691
+- SUG:NA
+- DESC:fix CVE-2021-26691
+
 * Tue Jan 26 2021 xihaochen<xihaochen@huawei.com> - 2.4.46-1
 - Type:requirements
 - ID:NA