rpms/mod_security
6
0
Fork 0
Code Issues Pull Requests Releases Activity

import UBI mod_security-2.9.6-2.el9_6

Browse Source
This commit is contained in:
eabdullin 2025-06-11 14:51:46 +00:00
parent 862f4ffa4a
commit 09993d343e
2 changed files with 54 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
SOURCES/mod_security-2.9.6-CVE-2025-47947.patch Normal file
View File

@ -0,0 +1,48 @@
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2025-47947
https://github.com/owasp-modsecurity/ModSecurity/commit/26161b907e792e53d01c7293e630240db13e28b3
--- modsecurity-2.9.6/apache2/modsecurity.h.cve47947
+++ modsecurity-2.9.6/apache2/modsecurity.h
@@ -693,6 +693,7 @@
unsigned int value_origin_offset;
unsigned int value_origin_len;
const char *origin;
+ unsigned int marked_for_sanitization;
};
struct msc_string {
--- modsecurity-2.9.6/apache2/msc_json.c.cve47947
+++ modsecurity-2.9.6/apache2/msc_json.c
@@ -58,6 +58,7 @@
arg->name, arg->value);
}
+ arg->marked_for_sanitization = 0;
apr_table_addn(msr->arguments,
log_escape_nq_ex(msr->mp, arg->name, arg->name_len), (void *) arg);
--- modsecurity-2.9.6/apache2/msc_parsers.c.cve47947
+++ modsecurity-2.9.6/apache2/msc_parsers.c
@@ -340,6 +340,7 @@
*/
void add_argument(modsec_rec *msr, apr_table_t *arguments, msc_arg *arg)
{
+ arg->marked_for_sanitization = 0;
if (msr->txcfg->debuglog_level >= 5) {
msr_log(msr, 5, "Adding request argument (%s): name \"%s\", value \"%s\"",
arg->origin, log_escape_ex(msr->mp, arg->name, arg->name_len),
--- modsecurity-2.9.6/apache2/re_actions.c.cve47947
+++ modsecurity-2.9.6/apache2/re_actions.c
@@ -1413,8 +1413,9 @@
telts = (const apr_table_entry_t*)tarr->elts;
for (i = 0; i < tarr->nelts; i++) {
msc_arg *arg = (msc_arg *)telts[i].val;
- if (strcasecmp(sargname, arg->name) == 0) {
+ if (arg->marked_for_sanitization == 0 && strcasecmp(sargname, arg->name) == 0) {
apr_table_addn(msr->arguments_to_sanitize, arg->name, (void *)arg);
+ arg->marked_for_sanitization = 1;
}
}
break;

7
SPECS/mod_security.spec
View File

@ -10,7 +10,7 @@
Summary: Security module for the Apache HTTP Server
Name: mod_security
Version: 2.9.6
Release: 1%{?dist}
Release: 2%{?dist}
License: ASL 2.0
URL: http://www.modsecurity.org/
Source: https://github.com/SpiderLabs/ModSecurity/releases/download/v%{version}/modsecurity-%{version}.tar.gz
@ -20,6 +20,7 @@ Source3: modsecurity_localrules.conf
Patch0: modsecurity-2.9.3-lua-54.patch
Patch1: modsecurity-2.9.3-apulibs.patch
Patch2: mod_security-2.9.3-remote-rules-timeout.patch
Patch3: mod_security-2.9.6-CVE-2025-47947.patch
Requires: httpd httpd-mmn = %{_httpd_mmn}
%if 0%{?fedora} || 0%{?rhel} > 7
@ -143,6 +144,10 @@ install -m0644 mlogc/mlogc-default.conf %{buildroot}%{_sysconfdir}/mlogc.conf
%endif
%changelog
* Thu May 29 2025 Joe Orton <jorton@redhat.com> - 2.9.6-2
- add fix for CVE-2025-47947
- Resolves: RHEL-93016
* Wed Nov 16 2022 Luboš Uhliarik <luhliari@redhat.com> - 2.9.6-1
- new version 2.9.6
- Resolves: #2143211 - [RFE] upgrade mod_security to 2.9.6