The release of Apache HTTP Server 2.4.65 has been announced, which fixes a critical bug in mod_rewrite that caused conditions specified by the "RewriteCond" expression to always return "true", meaning the rules always triggered regardless of the checked data. The "RewriteCond" expression is key in mod_rewrite and is used to check conditions in most situations.
The issue was caused by an improper modification in the previous release and only occurs in Apache httpd version 2.4.64. In version 2.4.64, an enumeration called cond_return_type was added to determine the outcome of the check, which could take values of COND_RC_NOMATCH, COND_RC_MATCH, and COND_RC_STATUS_SET. However, the code only set the value to COND_RC_MATCH, regardless of the result of the regular expression processing (it only checked the negative value with the error code, ignoring the zero value returned on non-matching).
Source: opennet.ru
