mod_wsgi 4.6.8.post1: backport CVE-2022-2255

[icanhasmath]

ActiveState security release of mod_wsgi 4.6.8, the version this line ships.

CVE	Level	Fixed upstream in	Status
CVE-2022-2255 (GHSA-7527-8855-9cf8)	Medium	4.9.3	Patched

The vulnerability

With WSGITrustedProxies / WSGITrustedProxyHeaders (or mod_wsgi-express --trust-proxy / --trust-proxy-header) configured to trust X-Client-IP, a request from a client that is not a trusted proxy did not get HTTP_X_CLIENT_IP stripped from the WSGI environment.

4.6.8 has the vulnerable code verbatim at src/server/mod_wsgi.c:13944-13945: the untrusted-client branch sets match_client_header for HTTP_X_FORWARDED_FOR and HTTP_X_REAL_IP but not HTTP_X_CLIENT_IP, and match_client_header is what drives the loop that unsets every header in wsgi_proxy_client_headers[]. X-Client-IP is in that array and is handled correctly in the trusted-proxy branch above, so the omission meant the drop loop simply never ran for that configuration.

REMOTE_ADDR was correctly left alone, so an application reading only REMOTE_ADDR was unaffected. An application also running middleware that re-processes proxy headers (ProxyFix, Django's USE_X_FORWARDED_*) could be induced to trust a spoofed client address.

The fix

One line, matching upstream commit af3c0c2736bc: add HTTP_X_CLIENT_IP to the check.

Versioning

MOD_WSGI_VERSION_STRING becomes "4.6.8.post1" — that is what setup.py's _version() parses and what appears in the Server header.

MOD_WSGI_MAJORVERSION_NUMBER / MINORVERSION_NUMBER / MICROVERSION_NUMBER are deliberately left at 4/6/8. Those three macros are the only source of the mod_wsgi.version (iii) tuple exposed to WSGI applications (mod_wsgi.c:2747, mod_wsgi.c:14399, wsgi_interp.c:1156), so leaving them numeric and unchanged preserves existing mod_wsgi.version >= (4, 6, 8) comparisons.

Testing

Not compiled or run. This environment has no Apache development headers (no apxs, no httpd.h), so the change is unverified beyond review. It is a single || clause added to an existing chain, structurally identical to the trusted-proxy branch 20 lines above and to upstream's own diff. It should be built against Apache before the tag is cut.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Backports the upstream fix for CVE-2022-2255 to the 4.6.8 line by ensuring X-Client-IP is stripped from the WSGI environment when a request comes from an untrusted client (even if WSGITrustedProxyHeaders is configured to trust it). Also bumps the human-readable/package version string to 4.6.8.post1 and documents the security release.

Changes:

• Fix proxy-header sanitization so HTTP_X_CLIENT_IP is included in the “untrusted client” header-stripping path.
• Update MOD_WSGI_VERSION_STRING to 4.6.8.post1 while leaving the numeric (4, 6, 8) tuple intact.
• Add and link release notes describing the CVE and behavioral impact.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
src/server/wsgi_version.h	Bumps MOD_WSGI_VERSION_STRING to 4.6.8.post1 without changing the numeric version macros.
src/server/mod_wsgi.c	Adds HTTP_X_CLIENT_IP to the untrusted-client match so the header-removal loop runs for that configuration.
docs/release-notes/version-4.6.8.post1.rst	Documents the 4.6.8.post1 security release and CVE-2022-2255 backport details.
docs/release-notes.rst	Adds the new 4.6.8.post1 release notes page to the toctree.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.