After updating httpd under RHEL, the web interface to Mailman started failing with:

<pre>
Bad Request
Your browser sent a request that this server could not understand.
</pre>

<p>This was caused in part by
<a href="https://httpd.apache.org/security/vulnerabilities_22.html"> Fixed in Apache httpd 2.2.32
important: Apache HTTP Request Parsing Whitespace Defects (CVE-2016-8743)</a></p>

<p>One workaround was to add </p>
<pre>
   HttpProtocolOptions Unsafe
</pre>
<p>to http-vhosts.conf for each host.</p>

<p>However, it would be better to send proper Http, see <a href="http://httpd.apache.org/docs/2.4/mod/core.html#httpprotocoloptions">HttpProtocolOptions Directive</a>.</p>

<p>Even with the above change, there were still problems.</p>

<p>One thing that was necessary was to edit <code>include/mail.inc.php</code> and modify <code> mail_getAdminCookie()</code> so that it properly found the cookie.</p>

<p>However, the problems continued where I was still getting a password request page.  I ended up reverting the patch to httpd.</p>

<p>The problems still continued, where I was getting the password page.</p>

<p>I reverted my changes in ~www/php and the problem went away!</p>

<p>It turns out that in <code>include/mail.inc.php</code>:</p>
<pre>
/** Get an administration page via HTTP GET.                                    
 */
function getAdminPage_get($fullURL, $cookie) {

    $cookieName = $cookie['name'];
    $cookieValue = $cookie['value'];

    $text = "";
    $fp = fsockopen($_SERVER['SERVER_NAME'], 80, $errno, $errstr);
    if(!$fp) {
	/* FIXME: better error handling needed */
	echo "Connect to ${_SERVER['SERVER_NAME']} failed<br/>n";
        echo "$errstr ($errno)<br/>n";
    } else {
        /* Initialize the remote filename, then get the contents. */
        fputs($fp, "GET $fullURL HTTP/1.0n");
</pre>
I modified the last fputs to be 
<pre>
        fputs($fp, "GET $fullURL HTTP/1.0rnrn");
</pre>
and the problems came back.</p>

<p>The next step is to try the patch again.</p>

<p>To update without updating httpd:</p>
<pre>
yum update --exclude httpd* --exclude mod_ssl*
</pre>