CVE-2003-0789

An attacker can send a request that triggers a CGI redirect path. Under a threaded MPM, `mod_cgid` does not properly associate the CGI redirect response with the correct client connection. This race condition or state confusion can cause the output of a CGI program to be delivered to a different client than the one that made the request, potentially leaking sensitive information.

The vulnerability resides in the CGI redirect path handling within `mod_cgid` when Apache uses a threaded MPM. The patch does not directly modify `mod_cgid` source files, but the tag `APACHE_2_0_48` indicates the fix was included in that release. The advisory states the issue is in `mod_cgid`'s handling of CGI redirect paths, which could cause output to be sent to the wrong client.

The patch provided is the tag for Apache 2.0.48, which includes the fix for this vulnerability. The actual code changes that close the vulnerability are not visible in this diff — the patch only shows build system and header file adjustments (removal of `mod_status.h`, minor changes to `mod_rewrite.h` and `mod_proxy.c`). The advisory does not specify the exact code change, but the fix was released in Apache 2.0.48 to properly handle CGI redirect paths in threaded MPM configurations.