diff --git a/mod_security-fix-error-500-for-invalid-requests.patch b/mod_security-fix-error-500-for-invalid-requests.patch new file mode 100644 index 0000000..0db1676 --- /dev/null +++ b/mod_security-fix-error-500-for-invalid-requests.patch @@ -0,0 +1,49 @@ +From f9c253952c564ffefd6c10b8327ef836832facea Mon Sep 17 00:00:00 2001 +From: root +Date: Fri, 29 Jan 2016 08:43:28 +0000 +Subject: [PATCH] This is fix for reborn of + https://github.com/SpiderLabs/ModSecurity/issues/334 This bug has been + reborn, because Apache (at least in RedHat/CentOS) since version 2.2.15-47 + returns in same case APR_INCOMPLETE (not APR_EOF). Based on same patch I have + added handler for APR_INCOMPLETE. + +--- + apache2/apache2_io.c | 3 +++ + apache2/mod_security2.c | 7 +++++++ + 2 files changed, 10 insertions(+) + +diff --git a/apache2/apache2_io.c b/apache2/apache2_io.c +index 0d59613..c14dd41 100644 +--- a/apache2/apache2_io.c ++++ b/apache2/apache2_io.c +@@ -208,6 +208,9 @@ apr_status_t read_request_body(modsec_rec *msr, char **error_msg) { + * too large and APR_EGENERAL when the client disconnects. + */ + switch(rc) { ++ case APR_INCOMPLETE : ++ *error_msg = apr_psprintf(msr->mp, "Error reading request body: %s", get_apr_error(msr->mp, rc)); ++ return -7; + case APR_EOF : + *error_msg = apr_psprintf(msr->mp, "Error reading request body: %s", get_apr_error(msr->mp, rc)); + return -6; +diff --git a/apache2/mod_security2.c b/apache2/mod_security2.c +index 5404fd8..14e9f44 100644 +--- a/apache2/mod_security2.c ++++ b/apache2/mod_security2.c +@@ -1030,6 +1030,13 @@ static int hook_request_late(request_rec *r) { + r->connection->keepalive = AP_CONN_CLOSE; + return HTTP_BAD_REQUEST; + break; ++ case -7 : /* Partial recieved */ ++ if (my_error_msg != NULL) { ++ msr_log(msr, 4, "%s", my_error_msg); ++ } ++ r->connection->keepalive = AP_CONN_CLOSE; ++ return HTTP_BAD_REQUEST; ++ break; + default : + /* allow through */ + break; +-- +2.7.4 + diff --git a/mod_security.spec b/mod_security.spec index e1e1252..505d036 100644 --- a/mod_security.spec +++ b/mod_security.spec @@ -10,7 +10,7 @@ Summary: Security module for the Apache HTTP Server Name: mod_security Version: 2.7.3 -Release: 3%{?dist} +Release: 4%{?dist} License: ASL 2.0 URL: http://www.modsecurity.org/ Group: System Environment/Daemons @@ -19,6 +19,7 @@ Source1: mod_security.conf Source2: 10-mod_security.conf Patch0: mod_security-2.7.3-fix-mem-leak-and-cve-2013-2765.patch Patch1: mod_security-2.7.6-fix_chunked_string_case_sensitive_issue-cve-2013-5705.patch +Patch2: mod_security-fix-error-500-for-invalid-requests.patch Requires: httpd httpd-mmn = %{_httpd_mmn} BuildRequires: httpd-devel libxml2-devel pcre-devel curl-devel lua-devel @@ -41,6 +42,7 @@ This package contains the ModSecurity Audit Log Collector. %setup -q -n modsecurity-apache_%{version} %patch0 -p1 %patch1 -p1 +%patch2 -p1 %build %configure --enable-pcre-match-limit=1000000 \ @@ -111,6 +113,9 @@ rm -rf %{buildroot} %endif %changelog +* Thu Jun 16 2016 Athmane Madjoudj - 2.7.3-4 +- Add a fix for failing on PUT/POST requests with http 500 error (RHBZ #1344471) + * Tue Apr 01 2014 Athmane Madjoudj 2.7.3-3 - Fix Chunked string case sensitive issue (CVE-2013-5705, RHBZ #1082904 #1082905 #1082906)