Apache HTTP Server 2.4.65 has been released, fixing a critical bug in mod_rewrite whereby conditions specified via the "RewriteCond" expression always returned "true", meaning that the rules always worked, regardless of the data being checked. The "RewriteCond" expression is key to mod_rewrite and is used to check conditions in most situations.
The issue is caused by an incorrect change in the previous release and only appears in Apache httpd 2.4.64. In 2.4.64, the cond_return_type enumeration was added to determine the check result, which could take the values COND_RC_NOMATCH, COND_RC_MATCH, and COND_RC_STATUS_SET. In this case, only the COND_RC_MATCH value was set in the code, regardless of the result of processing the regular expression (only a negative value with an error code was checked, but the zero value returned in case of a mismatch was not taken into account).
Source: opennet.ru
