demus/mod_security-rpm
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add a fix for failing on PUT/POST requests with http 500 error (RHBZ

Browse Source
This commit is contained in:
Athmane Madjoudj 2016-06-16 01:02:47 +00:00
parent b47bf84e3d
commit f70d5cb5bf
2 changed files with 55 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

49
mod_security-fix-error-500-for-invalid-requests.patch Normal file
View File

@ -0,0 +1,49 @@
From f9c253952c564ffefd6c10b8327ef836832facea Mon Sep 17 00:00:00 2001
From: root <root@ip-10-124-52-70.us-east-1.aws.cloud.in.here.com>
Date: Fri, 29 Jan 2016 08:43:28 +0000
Subject: [PATCH] This is fix for reborn of
https://github.com/SpiderLabs/ModSecurity/issues/334 This bug has been
reborn, because Apache (at least in RedHat/CentOS) since version 2.2.15-47
returns in same case APR_INCOMPLETE (not APR_EOF). Based on same patch I have
added handler for APR_INCOMPLETE.
---
apache2/apache2_io.c | 3 +++
apache2/mod_security2.c | 7 +++++++
2 files changed, 10 insertions(+)
diff --git a/apache2/apache2_io.c b/apache2/apache2_io.c
index 0d59613..c14dd41 100644
--- a/apache2/apache2_io.c
+++ b/apache2/apache2_io.c
@@ -208,6 +208,9 @@ apr_status_t read_request_body(modsec_rec *msr, char **error_msg) {
* too large and APR_EGENERAL when the client disconnects.
*/
switch(rc) {
+ case APR_INCOMPLETE :
+ *error_msg = apr_psprintf(msr->mp, "Error reading request body: %s", get_apr_error(msr->mp, rc));
+ return -7;
case APR_EOF :
*error_msg = apr_psprintf(msr->mp, "Error reading request body: %s", get_apr_error(msr->mp, rc));
return -6;
diff --git a/apache2/mod_security2.c b/apache2/mod_security2.c
index 5404fd8..14e9f44 100644
--- a/apache2/mod_security2.c
+++ b/apache2/mod_security2.c
@@ -1030,6 +1030,13 @@ static int hook_request_late(request_rec *r) {
r->connection->keepalive = AP_CONN_CLOSE;
return HTTP_BAD_REQUEST;
break;
+ case -7 : /* Partial recieved */
+ if (my_error_msg != NULL) {
+ msr_log(msr, 4, "%s", my_error_msg);
+ }
+ r->connection->keepalive = AP_CONN_CLOSE;
+ return HTTP_BAD_REQUEST;
+ break;
default :
/* allow through */
break;
--
2.7.4

7
mod_security.spec
View File

@ -10,7 +10,7 @@
Summary: Security module for the Apache HTTP Server
Name: mod_security
Version: 2.7.3
Release: 3%{?dist}
Release: 4%{?dist}
License: ASL 2.0
URL: http://www.modsecurity.org/
Group: System Environment/Daemons
@ -19,6 +19,7 @@ Source1: mod_security.conf
Source2: 10-mod_security.conf
Patch0: mod_security-2.7.3-fix-mem-leak-and-cve-2013-2765.patch
Patch1: mod_security-2.7.6-fix_chunked_string_case_sensitive_issue-cve-2013-5705.patch
Patch2: mod_security-fix-error-500-for-invalid-requests.patch
Requires: httpd httpd-mmn = %{_httpd_mmn}
BuildRequires: httpd-devel libxml2-devel pcre-devel curl-devel lua-devel
@ -41,6 +42,7 @@ This package contains the ModSecurity Audit Log Collector.
%setup -q -n modsecurity-apache_%{version}
%patch0 -p1
%patch1 -p1
%patch2 -p1
%build
%configure --enable-pcre-match-limit=1000000 \
@ -111,6 +113,9 @@ rm -rf %{buildroot}
%endif
%changelog
* Thu Jun 16 2016 Athmane Madjoudj <athmane@fedoraproject.org> - 2.7.3-4
- Add a fix for failing on PUT/POST requests with http 500 error (RHBZ #1344471)
* Tue Apr 01 2014 Athmane Madjoudj <athmane@fedoraproject.org> 2.7.3-3
- Fix Chunked string case sensitive issue (CVE-2013-5705, RHBZ #1082904 #1082905 #1082906)