Dear Maintainer,

Following DSA 5729-1 (2.4.61-1~deb12u1), access to Sympa broke.
User error: Bad Request
Log error: AH01059: error parsing URL //: Invalid host/port

I believe the issue is related to this line:
   SetHandler "proxy:unix:/run/sympa/wwsympa.socket|fcgi://"
This is the default configuration from the sympa Debian package.

I get the same result when compiling the debdiff from:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1076531
(2.4.62)

I can work-around the issue by appending 'localhost':
   SetHandler "proxy:unix:/run/sympa/wwsympa.socket|fcgi://localhost"
(but this is still a regression in the stable release :))

Same here. Big thanks for the workaround.

We believe that the bug you reported is fixed in the latest version of
apache2, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1076554@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Bastien Roucariès <rouca@debian.org> (supplier of updated apache2 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 05 Oct 2024 18:11:40 +0000
Source: apache2
Architecture: source
Version: 2.4.62-4
Distribution: experimental
Urgency: medium
Maintainer: Debian Apache Maintainers <debian-apache@lists.debian.org>
Changed-By: Bastien Roucariès <rouca@debian.org>
Closes: 1076554
Changes:
 apache2 (2.4.62-4) experimental; urgency=medium
 .
   * Fix CVE-2024-38473 regression: error parsing URL //: Invalid host/port
     SetHandler "proxy:unix:/run/sympa/wwsympa.socket|fcgi://" failed
     with AH01059: error
     (Closes: #1076554)
Checksums-Sha1:
 9c3724de9cd8905d6066e4030ac9b6cfd2238a33 3469 apache2_2.4.62-4.dsc
 b37cac74da56e827a434745c4e2bb188c101c0ec 826864 apache2_2.4.62-4.debian.tar.xz
 237b8e7742d73bd5c933f9215de8fcb5601fba6d 11846 apache2_2.4.62-4_amd64.buildinfo
Checksums-Sha256:
 63941e5c01fd4b6984a6e398ea9d17442d113b244d269d8657f7205bbf1cb61e 3469 apache2_2.4.62-4.dsc
 c79505cf3901af68680be886bef0fa669fc48323451d2df63db3f336d2aabc75 826864 apache2_2.4.62-4.debian.tar.xz
 7625ac87b6ecbc293fff5ef689ba4c685ef7a7b1ddb1f1b1f7e4a3bad97963c5 11846 apache2_2.4.62-4_amd64.buildinfo
Files:
 5181e187c6590de63cd9d60e179bd06a 3469 httpd optional apache2_2.4.62-4.dsc
 16f496dcbb4e1d9e955466a4bfb0ce0b 826864 httpd optional apache2_2.4.62-4.debian.tar.xz
 295f63944f78bdf7504805d2fa0c7b7b 11846 httpd optional apache2_2.4.62-4_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJFBAEBCgAvFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAmcBhOQRHHJvdWNhQGRl
Ymlhbi5vcmcACgkQADoaLapBCF/ZwQ//fBtLAE1yq1S59YrMKQ/YSHzyAqvQEcMS
4CbTGyxk6SmhRxhdseAYCgU0x6Bs3WtH3sHPJ17cU4qb/z4ii08uozGafqtNwsmt
Tg3IKdhxIN/zjGduFjb/BMidPPDBs/5UvkHdNBjvdmBms78tLXp96BlIfVFIDI96
gzdARVIft0TNpuefZ3UaxoghhRNTqnuCPbTbmtx/EZL0d+KJjMAhtlOWcy1H1OXe
uhhIv57njMYQW1tvZVOvntwufAa17KfryvWXrOVsBYOMT1Ldc4FqWd33m/NZ2MzL
MkJMAqSVFvkVtBaSUHk6OBecIsx5o658LSfDkby7awIUmoLRuPlGmEBo7KTZmEmh
QmawHwDp5KibRD3FHqQrLZORqZz5HeKNs9hRxDgq3iiyq3ndGmEB2c93LaIH37FH
6R6eWNLOoqiwoiTSigMYev2AUiPBi03Bt3/VdJrvdWtp3Qhzhnznqi0ACR9fxPdG
OUA6LBcI84Aal4ag2b7guxkRrIUFgpMFrmMtCvWQTau+6BwE0SvtbV5Y5/8CjK2W
phtRZGnavRFtvO012aod6Fxc1oVVBII/4b6eblTCY2LgfLwPx4CNzETArwXrh1gw
u605x7ZnbdtDS89l7MgUoZ2UjdMr8zS3a8DFItnDQ6b4Fvx/3XGjku9QDCS3BXgB
+NNGHbTON3U=
=8wy2
-----END PGP SIGNATURE-----

Nay Myo Oo

0990637253

Nay Myo Oo

NayMyoOo

Nay Myo Oo