mirror of
https://github.com/gentoo-mirror/gentoo.git
synced 2026-11-09 06:37:10 -08:00
www-apache/mod_perl: Sec cleanup 2.0.11 re bug #672086
Removing versions affected by CVE-2011-2767 Bug: https://bugs.gentoo.org/672086 Bug: https://rt.cpan.org/Public/Bug/Display.html?id=126984 Bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=644169 Bug: https://bugzilla.redhat.com/show_bug.cgi?id=1623265 Bug: https://nvd.nist.gov/vuln/detail/CVE-2011-2767 Bug: https://www.cvedetails.com/cve/CVE-2011-2767/ Package-Manager: Portage-2.3.99, Repoman-2.3.22 Signed-off-by: Kent Fredric <kentnl@gentoo.org>
This commit is contained in:
Kent Fredric
@@ -1,2 +1 @@
|
||||
DIST mod_perl-2.0.10.tar.gz 3846211 BLAKE2B de44c76d22cc90984be20193bb635f27d68fbc25cab39333be93ee15c4636025d9e6d8f7bfc661b50ac19cfeb5f697f957acb7fbbb38e1f3f712c81ac27737ab SHA512 0bf1a885cb32a3393e95f87e71983097613e263b9052dbf22494663b506e36a25d0256afed24285232276d9f43ebd3adaa18b91129bfb62116a8ccb023855bca
|
||||
DIST mod_perl-2.0.11.tar.gz 3848147 BLAKE2B 8eeef6d1fadbf9d2e3bcff33c5114e588f032c2497f5191b1edd30da8bce72eadf5ea62482ec8ece7d7fde308c8c41d6682d1a325760c627bee75c3ce8cf6272 SHA512 f232b215ccb9217f69ccced8a037470e5975900b9a6fcc5a2e4674e6559d21f026547c1b97c48109352043946dc22539dd38004759be16ad5cfcb3a96973dfdf
|
||||
|
||||
@@ -1,33 +0,0 @@
|
||||
From f4dd0394f0975892b51a889f023d0e207553a656 Mon Sep 17 00:00:00 2001
|
||||
From: Niko Tyni <ntyni@debian.org>
|
||||
Date: Fri, 23 Dec 2016 18:27:23 +0200
|
||||
Subject: [PATCH 1/2] Fix t/apache/read.t HTTP syntax for Apache 2.4.25
|
||||
compatibility
|
||||
|
||||
HTTP/1.1 RFC 7230, section 2.6. "Protocol Versioning" says the HTTP name
|
||||
is case sensitive. Starting with Apache 2.4.25, using lower case will
|
||||
make the server issue a 400 Bad request response, causing a test failure.
|
||||
|
||||
https://tools.ietf.org/html/rfc7230#section-2.6
|
||||
|
||||
Bug-Debian: https://bugs.debian.org/849082
|
||||
---
|
||||
t/apache/read.t | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/t/apache/read.t b/t/apache/read.t
|
||||
index 83670c9..9f7f504 100644
|
||||
--- a/t/apache/read.t
|
||||
+++ b/t/apache/read.t
|
||||
@@ -24,7 +24,7 @@ close $fh;
|
||||
|
||||
my $size = length $data;
|
||||
|
||||
-for my $string ("POST $location http/1.0",
|
||||
+for my $string ("POST $location HTTP/1.0",
|
||||
"Content-length: $size",
|
||||
"") {
|
||||
my $line = "$string\r\n";
|
||||
--
|
||||
2.11.0
|
||||
|
||||
@@ -1,23 +0,0 @@
|
||||
Author: Stefan Fritsch <sf@sfritsch.de>
|
||||
Source: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=849082
|
||||
|
||||
--- ./t/filter/TestFilter/in_bbs_inject_header.pm.orig 2016-10-27 22:11:16.000000000 +0200
|
||||
+++ ./t/filter/TestFilter/in_bbs_inject_header.pm 2016-12-24 06:55:19.049606491 +0100
|
||||
@@ -181,7 +181,7 @@
|
||||
|
||||
if ($data and $data =~ /^POST/) {
|
||||
# demonstrate how to add a header while processing other headers
|
||||
- my $header = "$header1_key: $header1_val\n";
|
||||
+ my $header = "$header1_key: $header1_val\r\n";
|
||||
push @{ $ctx->{buckets} }, APR::Bucket->new($c->bucket_alloc, $header);
|
||||
debug "queued header [$header]";
|
||||
}
|
||||
@@ -199,7 +199,7 @@
|
||||
# we hit the headers and body separator, which is a good
|
||||
# time to add extra headers:
|
||||
for my $key (keys %headers) {
|
||||
- my $header = "$key: $headers{$key}\n";
|
||||
+ my $header = "$key: $headers{$key}\r\n";
|
||||
push @{ $ctx->{buckets} }, APR::Bucket->new($c->bucket_alloc, $header);
|
||||
debug "queued header [$header]";
|
||||
}
|
||||
@@ -1,140 +0,0 @@
|
||||
# Copyright 1999-2020 Gentoo Authors
|
||||
# Distributed under the terms of the GNU General Public License v2
|
||||
|
||||
EAPI=5
|
||||
|
||||
inherit depend.apache apache-module perl-module eutils
|
||||
|
||||
DESCRIPTION="An embedded Perl interpreter for Apache2"
|
||||
HOMEPAGE="https://perl.apache.org/ https://projects.apache.org/project.html?perl-mod_perl"
|
||||
SRC_URI="mirror://apache/perl/${P}.tar.gz"
|
||||
|
||||
LICENSE="Apache-2.0"
|
||||
SLOT="1"
|
||||
KEYWORDS="~alpha amd64 ~arm ppc ppc64 x86"
|
||||
IUSE="debug ithreads test"
|
||||
RESTRICT="!test? ( test )"
|
||||
|
||||
SRC_TEST=do
|
||||
|
||||
# Apache::Reload, Apache::SizeLimit, and Apache::Test are force-unbundled.
|
||||
# The minimum versions requested here are the bundled versions.
|
||||
|
||||
# The test dependencies are from CPAN (Bundle::Apache2).
|
||||
|
||||
# When all MPMs are disabled via useflags, the apache ebuild selects a
|
||||
# default one, which will likely need threading.
|
||||
|
||||
RDEPEND="
|
||||
dev-lang/perl[ithreads=]
|
||||
>=dev-perl/Apache-Test-1.400.0
|
||||
>=www-servers/apache-2.0.47
|
||||
>=dev-libs/apr-util-1.4
|
||||
!ithreads? ( www-servers/apache[-apache2_mpms_event,-apache2_mpms_worker,apache2_mpms_prefork] )
|
||||
"
|
||||
DEPEND="${RDEPEND}
|
||||
dev-perl/Module-Build
|
||||
test? (
|
||||
>=dev-perl/CGI-3.110.0
|
||||
dev-perl/Chatbot-Eliza
|
||||
dev-perl/Devel-Symdump
|
||||
dev-perl/HTML-Parser
|
||||
dev-perl/IPC-Run3
|
||||
dev-perl/libwww-perl
|
||||
www-servers/apache[apache2_modules_version,-apache2_modules_unique_id]
|
||||
!www-apache/mpm_itk
|
||||
)
|
||||
"
|
||||
PDEPEND="
|
||||
>=dev-perl/Apache-Reload-0.130.0
|
||||
>=dev-perl/Apache-SizeLimit-0.970.0
|
||||
"
|
||||
|
||||
APACHE2_MOD_FILE="${S}/src/modules/perl/mod_perl.so"
|
||||
APACHE2_MOD_CONF="2.0.3/75_${PN}"
|
||||
APACHE2_MOD_DEFINE="PERL"
|
||||
|
||||
need_apache2
|
||||
|
||||
PATCHES=(
|
||||
"${FILESDIR}/${PN}"-2.0.1-sneak-tmpdir.patch # seems to fix the make test problem
|
||||
"${FILESDIR}/${PN}"-2.0.4-inline.patch # 550244
|
||||
"${FILESDIR}/${PN}"-2.0.10_rc1-bundled-Apache-Test.patch # 352724
|
||||
"${FILESDIR}/${PN}"-2.0.10_rc1-Gentoo-not-Unix.patch
|
||||
"${FILESDIR}/${PN}"-2.0.10-apache24-tests-1.patch # 614684
|
||||
"${FILESDIR}/${PN}"-2.0.10-apache24-tests-2.patch # 614684
|
||||
)
|
||||
|
||||
src_prepare() {
|
||||
perl-module_src_prepare
|
||||
|
||||
# chainsaw unbundling
|
||||
rm -rf Apache-{Test,Reload,SizeLimit}/ lib/Bundle/ || die
|
||||
}
|
||||
|
||||
src_configure() {
|
||||
local debug=$(usex debug 1 0)
|
||||
local nothreads=$(usex ithreads 0 1)
|
||||
myconf=(
|
||||
MP_USE_DSO=1
|
||||
MP_APXS=${APXS}
|
||||
MP_APR_CONFIG=/usr/bin/apr-1-config
|
||||
MP_TRACE=${debug}
|
||||
MP_DEBUG=${debug}
|
||||
MP_NO_THREADS=${nothreads}
|
||||
)
|
||||
|
||||
perl-module_src_configure
|
||||
}
|
||||
|
||||
src_test() {
|
||||
# make test notes whether it is running as root, and drops
|
||||
# privileges all the way to "nobody" if so, so we must adjust
|
||||
# write permissions accordingly in this case.
|
||||
|
||||
# IF YOU SUDO TO EMERGE AND HAVE !env_reset set testing will fail!
|
||||
if [[ "$(id -u)" == "0" ]]; then
|
||||
chown nobody:nobody "${WORKDIR}" "${T}" || die
|
||||
fi
|
||||
|
||||
# We force verbose tests for now to get meaningful bug reports.
|
||||
MAKEOPTS+=" -j1"
|
||||
TMPDIR="${T}" HOME="${T}/" TEST_VERBOSE=1 perl-module_src_test
|
||||
}
|
||||
|
||||
src_install() {
|
||||
apache-module_src_install
|
||||
|
||||
default
|
||||
|
||||
perl_delete_localpod
|
||||
perl_delete_packlist
|
||||
|
||||
insinto "${APACHE_MODULES_CONFDIR}"
|
||||
doins "${FILESDIR}"/2.0.3/apache2-mod_perl-startup.pl
|
||||
|
||||
# this is an attempt to get @INC in line with /usr/bin/perl.
|
||||
# there is blib garbage in the mainstream one that can only be
|
||||
# useful during internal testing, so we wait until here and then
|
||||
# just go with a clean slate. should be much easier to see what's
|
||||
# happening and revert if problematic.
|
||||
|
||||
perl_set_version
|
||||
sed -i \
|
||||
-e "s,-I${S}/[^[:space:]\"\']\+[[:space:]]\?,,g" \
|
||||
-e "s,-typemap[[:space:]]${S}/[^[:space:]\"\']\+[[:space:]]\?,,g" \
|
||||
-e "s,${S}\(/[^[:space:]\"\']\+\)\?,/,g" \
|
||||
"${D}/${VENDOR_ARCH}/Apache2/BuildConfig.pm" || die
|
||||
|
||||
local fname
|
||||
for fname in $(find "${D}" -type f -not -name '*.so'); do
|
||||
grep -q "\(${D}\|${S}\)" "${fname}" && ewarn "QA: File contains a temporary path ${fname}"
|
||||
sed -i -e "s:\(${D}\|${S}\):/:g" ${fname} || die
|
||||
done
|
||||
|
||||
perl_remove_temppath
|
||||
}
|
||||
|
||||
pkg_postinst() {
|
||||
apache-module_pkg_postinst
|
||||
}
|
||||
Reference in New Issue
Block a user