diff --git a/.gitignore b/.gitignore index a68b232..def3c6d 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -SOURCES/modsecurity-apache_2.7.3.tar.gz +SOURCES/modsecurity-2.9.2.tar.gz diff --git a/.mod_security.metadata b/.mod_security.metadata index 93b3e9f..1f6befd 100644 --- a/.mod_security.metadata +++ b/.mod_security.metadata @@ -1 +1 @@ -38b352e85a9d12b26a1da9433051b41e9f196936 SOURCES/modsecurity-apache_2.7.3.tar.gz +9f0aacc15990db6df3e32641332ae650c013adc3 SOURCES/modsecurity-2.9.2.tar.gz diff --git a/SOURCES/mod_security-2.7.3-fix-mem-leak-and-cve-2013-2765.patch b/SOURCES/mod_security-2.7.3-fix-mem-leak-and-cve-2013-2765.patch deleted file mode 100644 index 3913668..0000000 --- a/SOURCES/mod_security-2.7.3-fix-mem-leak-and-cve-2013-2765.patch +++ /dev/null @@ -1,23 +0,0 @@ -diff -ru modsecurity-apache_2.7.3.orig/apache2/msc_reqbody.c modsecurity-apache_2.7.3/apache2/msc_reqbody.c ---- modsecurity-apache_2.7.3.orig/apache2/msc_reqbody.c 2013-03-24 08:12:29.000000000 +0100 -+++ modsecurity-apache_2.7.3/apache2/msc_reqbody.c 2013-05-28 14:48:39.063673996 +0100 -@@ -170,6 +170,7 @@ - - /* Would storing this chunk mean going over the limit? */ - if ((msr->msc_reqbody_spilltodisk) -+ && (msr->txcfg->reqbody_buffering != REQUEST_BODY_FORCEBUF_ON) - && (msr->msc_reqbody_length + length > (apr_size_t)msr->txcfg->reqbody_inmemory_limit)) - { - msc_data_chunk **chunks; -diff -ru modsecurity-apache_2.7.3.orig/apache2/re_operators.c modsecurity-apache_2.7.3/apache2/re_operators.c ---- modsecurity-apache_2.7.3.orig/apache2/re_operators.c 2013-03-24 08:12:29.000000000 +0100 -+++ modsecurity-apache_2.7.3/apache2/re_operators.c 2013-05-28 14:49:30.448696404 +0100 -@@ -369,7 +369,7 @@ - /* rsub */ - - static char *param_remove_escape(msre_rule *rule, char *str, int len) { -- char *parm = apr_palloc(rule->ruleset->mp, len); -+ char *parm = apr_pcalloc(rule->ruleset->mp, len); - char *ret = parm; - - for(;*str!='\0';str++) { diff --git a/SOURCES/modsecurity-2.7.3-CVE-2013-5705.patch b/SOURCES/modsecurity-2.7.3-CVE-2013-5705.patch deleted file mode 100644 index 1b99904..0000000 --- a/SOURCES/modsecurity-2.7.3-CVE-2013-5705.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -up modsecurity-apache_2.7.3/apache2/modsecurity.c.CVE-2013-5705 modsecurity-apache_2.7.3/apache2/modsecurity.c ---- modsecurity-apache_2.7.3/apache2/modsecurity.c.CVE-2013-5705 2014-04-03 11:39:46.451454455 +0200 -+++ modsecurity-apache_2.7.3/apache2/modsecurity.c 2014-04-03 11:40:47.176660100 +0200 -@@ -297,7 +297,7 @@ apr_status_t modsecurity_tx_init(modsec_ - if (msr->request_content_length == -1) { - /* There's no C-L, but is chunked encoding used? */ - char *transfer_encoding = (char *)apr_table_get(msr->request_headers, "Transfer-Encoding"); -- if ((transfer_encoding != NULL)&&(strstr(transfer_encoding, "chunked") != NULL)) { -+ if ((transfer_encoding != NULL)&&(m_strcasestr(transfer_encoding, "chunked") != NULL)) { - msr->reqbody_should_exist = 1; - msr->reqbody_chunked = 1; - } diff --git a/SPECS/mod_security.spec b/SPECS/mod_security.spec index 1654e75..771304f 100644 --- a/SPECS/mod_security.spec +++ b/SPECS/mod_security.spec @@ -5,20 +5,18 @@ %{!?_httpd_confdir: %{expand: %%global _httpd_confdir %%{_sysconfdir}/httpd/conf.d}} %{!?_httpd_moddir: %{expand: %%global _httpd_moddir %%{_libdir}/httpd/modules}} -%global with_mlogc 0%{?fedora} || 0%{?rhel} <= 6 +%global with_mlogc 1 Summary: Security module for the Apache HTTP Server Name: mod_security -Version: 2.7.3 -Release: 5%{?dist} +Version: 2.9.2 +Release: 1%{?dist} License: ASL 2.0 URL: http://www.modsecurity.org/ Group: System Environment/Daemons -Source: http://www.modsecurity.org/tarball/%{version}/modsecurity-apache_%{version}.tar.gz +Source: https://www.modsecurity.org/tarball/%{version}/modsecurity-%{version}.tar.gz Source1: mod_security.conf Source2: 10-mod_security.conf -Patch0: mod_security-2.7.3-fix-mem-leak-and-cve-2013-2765.patch -Patch1: modsecurity-2.7.3-CVE-2013-5705.patch Requires: httpd httpd-mmn = %{_httpd_mmn} BuildRequires: httpd-devel libxml2-devel pcre-devel curl-devel lua-devel @@ -29,24 +27,28 @@ for web applications. It operates embedded into the web server, acting as a powerful umbrella - shielding web applications from attacks. %if %with_mlogc -%package -n mlogc +%package mlogc Summary: ModSecurity Audit Log Collector Group: System Environment/Daemons Requires: mod_security -%description -n mlogc +%description mlogc This package contains the ModSecurity Audit Log Collector. %endif %prep -%setup -q -n modsecurity-apache_%{version} -%patch0 -p1 -%patch1 -p1 +%setup -q -n modsecurity-%{version} %build %configure --enable-pcre-match-limit=1000000 \ --enable-pcre-match-limit-recursion=1000000 \ - --with-apxs=%{_httpd_apxs} + --with-apxs=%{_httpd_apxs} \ +%if %with_mlogc + --enable-mlogc \ +%else + --disable-mlogc \ +%endif + --enable-collection-global-lock # remove rpath sed -i 's|^hardcode_libdir_flag_spec=.*|hardcode_libdir_flag_spec=""|g' libtool sed -i 's|^runpath_var=LD_RUN_PATH|runpath_var=DIE_RPATH_DIE|g' libtool @@ -101,7 +103,7 @@ rm -rf %{buildroot} %attr(770,apache,root) %dir %{_localstatedir}/lib/%{name} %if %with_mlogc -%files -n mlogc +%files mlogc %defattr (-,root,root) %doc mlogc/INSTALL %attr(0640,root,apache) %config(noreplace) %{_sysconfdir}/mlogc.conf @@ -112,6 +114,17 @@ rm -rf %{buildroot} %endif %changelog +* Wed Sep 6 2017 Daniel Kopecek - 2.9.2-1 +- RHEL-7.5 erratum + - Update to 2.9.2 + - Fixed bogus dates in the spec file + - Enabled mlogc subpackage + - Enabled collection global lock to prevent collection + removal failures + Resolves: rhbz#1388656 + Resolves: rhbz#1139728 + Resolves: rhbz#1473420 + * Thu Apr 3 2014 Daniel Kopecek - 2.7.3-5 - Fix Chunked string case sensitive issue (CVE-2013-5705) Resolves: rhbz#1082907 @@ -196,7 +209,7 @@ rm -rf %{buildroot} * Fri Jan 13 2012 Fedora Release Engineering - 2.5.13-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild -* Wed May 3 2011 Michael Fleming - 2.5.13-1 +* Tue May 3 2011 Michael Fleming - 2.5.13-1 - Newer upstream version * Wed Jun 30 2010 Michael Fleming - 2.5.12-3 @@ -244,11 +257,10 @@ rm -rf %{buildroot} * Tue Feb 19 2008 Fedora Release Engineering - 2.1.5-3 - Autorebuild for GCC 4.3 -* Sat Jan 27 2008 Michael Fleming 2.1.5-2 +* Sun Jan 27 2008 Michael Fleming 2.1.5-2 - Update to 2.1.5 (bz#425986) - "blocking" -> "optional_rules" per tarball ;-) - * Thu Sep 13 2007 Michael Fleming 2.1.3-1 - Update to 2.1.3 - Update License tag per guidelines.