From owner-freebsd-ports-bugs@FreeBSD.ORG Sun Feb 14 14:05:07 2010 Return-Path: Delivered-To: freebsd-ports-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 43F451065672 for ; Sun, 14 Feb 2010 14:05:07 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id D86D78FC0C for ; Sun, 14 Feb 2010 14:05:06 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.3/8.14.3) with ESMTP id o1EE56Mh041108 for ; Sun, 14 Feb 2010 14:05:06 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.3/8.14.3/Submit) id o1EE56MK041107; Sun, 14 Feb 2010 14:05:06 GMT (envelope-from gnats) Resent-Date: Sun, 14 Feb 2010 14:05:06 GMT Resent-Message-Id: <201002141405.o1EE56MK041107@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-ports-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Andrei Lavreniyuk Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 57346106566C for ; Sun, 14 Feb 2010 11:59:49 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21]) by mx1.freebsd.org (Postfix) with ESMTP id 2D17B8FC08 for ; Sun, 14 Feb 2010 11:59:49 +0000 (UTC) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.14.3/8.14.3) with ESMTP id o1EBxmqN093762 for ; Sun, 14 Feb 2010 11:59:48 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.14.3/8.14.3/Submit) id o1EBxmJL093761; Sun, 14 Feb 2010 11:59:48 GMT (envelope-from nobody) Message-Id: <201002141159.o1EBxmJL093761@www.freebsd.org> Date: Sun, 14 Feb 2010 11:59:48 GMT From: Andrei Lavreniyuk To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: ports/143932: [UPDATE] ports/www/mod_security to version v2.5.12 X-BeenThere: freebsd-ports-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Ports bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 14 Feb 2010 14:05:07 -0000 >Number: 143932 >Category: ports >Synopsis: [UPDATE] ports/www/mod_security to version v2.5.12 >Confidential: no >Severity: serious >Priority: high >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sun Feb 14 14:05:06 UTC 2010 >Closed-Date: >Last-Modified: >Originator: Andrei Lavreniyuk >Release: FreeBSD 8.0-STABLE >Organization: Technica-03, Inc. >Environment: FreeBSD datacenter.technica-03.local 8.0-STABLE FreeBSD 8.0-STABLE #0: Sat Feb 13 11:01:53 EET 2010 root@datacenter.technica-03.local:/usr/obj/usr/src/sys/SMP64 amd64 >Description: Please update ports/www/mod_security to version v2.5.12 _____________________________________________________________ http://www.modsecurity.org/ of version v2.5.12: http://sourceforge.net/projects/mod-security/files/modsecurity-apache/2.5.12/CHANGES_2.5.12.txt/download More details from the SVN log: * r1488 | b1v1r | 2010-02-05 19:38:56 +0100 (Fri, 05 Feb 2010) | 1 line Cleanup path nomalization routine and add some further regression tests (MODSEC-123). * r1487 | b1v1r | 2010-02-05 19:26:43 +0100 (Fri, 05 Feb 2010) | 1 line Fixed SecUploadFileMode to set the correct mode (MODSEC-129). * r1486 | b1v1r | 2010-02-05 19:24:44 +0100 (Fri, 05 Feb 2010) | 1 line Fixed nolog,auditlog/noauditlog/nolog controls for disruptive actions (MODSEC-78, MODSEC-130) * r1479 | b1v1r | 2010-02-05 19:15:31 +0100 (Fri, 05 Feb 2010) | 1 line Added SecUploadFileLimit (MODSEC-116). * r1478 | b1v1r | 2010-02-05 19:14:08 +0100 (Fri, 05 Feb 2010) | 1 line Rewrote path normalization routine (MODSEC-123). * r1476 | b1v1r | 2010-02-05 19:12:53 +0100 (Fri, 05 Feb 2010) | 1 line Trim whitespace around phrases used with @pmFromFile and allow for both LF and CRLF terminated lines (MODSEC-126). * r1474 | b1v1r | 2010-02-05 19:11:36 +0100 (Fri, 05 Feb 2010) | 1 line Allow for more robust parsing for multipart header folding. Reported by Sogeti/ESEC R&D (MODSEC-118). Added additional multipart regression tests. * r1472 | b1v1r | 2010-02-05 19:09:19 +0100 (Fri, 05 Feb 2010) | 1 line Added PCRE limits and studying by default to help alleviate REDoS reported by Sogeti/ESEC R&D (MODSEC-119). * r1471 | b1v1r | 2010-02-05 19:07:56 +0100 (Fri, 05 Feb 2010) | 1 line Fixed memory leak in v1 cookie parser reported by Sogeti/ESEC R&D (MODSEC-121). Further references: http://secunia.com/advisories/38460/ http://freshmeat.net/projects/modsecurity/releases/312017 CVE Request: http://www.openwall.com/lists/oss-security/2010/02/10/2 >How-To-Repeat: >Fix: >Release-Note: >Audit-Trail: >Unformatted: