mod_sed duplicates lines (in 2.4.29-1ubuntu4.24)

[Cyan]

mod_sed can be used to modify content before it is sent back to the user, e.g. point URLs elsewhere.
This worked as expected in Ubuntu 18.04 up to and including version 2.4.29-1ubuntu4.23.
As of the Ubuntu 18.04 2.4.29-1ubuntu4.24 security update mod_sed now returns a mix of the original and modified content.

Example /tmp/apachemodsed/apache.conf:

    ServerRoot "/tmp/apachemodsed"
    PidFile "/tmp/apachemodsed/apache.pid"

    <Directory "/tmp/apachemodsed">
        Options Indexes FollowSymLinks
        AllowOverride None
        Require all granted
    </Directory>

    HostnameLookups off
    LogLevel debug
    ErrorLog /tmp/apachemodsed/error.log
    CustomLog /tmp/apachemodsed/access.log "%t %h %u %U \"%r\" %D %>s %O"

    LoadModule authn_core_module /usr/lib/apache2/modules/mod_authn_core.so
    LoadModule authz_core_module /usr/lib/apache2/modules/mod_authz_core.so
    LoadModule mpm_event_module /usr/lib/apache2/modules/mod_mpm_event.so
    LoadModule sed_module /usr/lib/apache2/modules/mod_sed.so
    #LoadModule sed_module /tmp/apachemodsed/2.4.29-1ubuntu4.23/mod_sed.so

    ServerName apachemodsed

    Listen 1234

    DocumentRoot /tmp/apachemodsed/

    <Location "/testfile">
        SetOutputFilter Sed
        OutputSed "s/two/four/"
    </Location>

Example /tmp/apachemodsed/testfile content:

    one
    two
    three

Run apache with:

    apache2 -f /tmp/apachemodsed/apache.conf -X

Expected output (given in 2.4.29-1ubuntu4.23 and below):

    one
    four
    three

Actual output (in 2.4.29-1ubuntu4.24):

    one
    one
    four
    two
    three

If mod_sed is being used to adjust URLs in HTML, the duplication of lines will badly break the HTML and any embedded scripting.

The only changes listed in the changelog for 2.4.29-1ubuntu4.24 are security fixes.
My guess is that this issue was introduced by this security fix:

    * SECURITY UPDATE: Denial of service
      - debian/patches/CVE-2022-30522.patch: limit mod_sed
        memory use in modules/filters/mod_sec.c,
        modules/filters/sed1.c.
      - CVE-2022-30522

[Leonidas S. Barbosa (leosilvab)]

Thanks for report this issue. I'm working on a regression update asap.

[Marc Deslauriers (mdeslaur)]

I am making this report public as it may be affecting more users.

[Launchpad Janitor (janitor)]

This bug was fixed in the package apache2 - 2.4.29-1ubuntu4.25

---------------
apache2 (2.4.29-1ubuntu4.25) bionic-security; urgency=medium

  * SECURITY REGRESSION: Previous fix for CVE-2022-30522 caused
    a regression
    - debian/patches/CVE-2022-30522.patch: removing line should be removed
      at the backport but was missing in modules/filters/sed1.c (LP: #1979641)

 -- Leonidas Da Silva Barbosa <email address hidden> Thu, 23 Jun 2022 09:51:37 -0300

[Cyan (cyantechnology)]

I can confirm that 2.4.29-1ubuntu4.25 fixes the mod_sed issue for my use case.
Many thanks for the swift resolution.

[Paride Legovini (paride)]

I'm setting the devel release task status to Invalid as this bug never affected an Ubuntu devel release.