Changes - j0ke.net Open Build Service

Changes of Revision 23

[-] [+]	Changed	mod_security-ix.changes
@@ -1,4 +1,9 @@ ------------------------------------------------------------------- +Sat Jun 29 17:00:16 UTC 2013 - cs@linux-administrator.com + +- added CVE-2013-2765.patch for 2.6.8 (included in 2.7.4) + +------------------------------------------------------------------- Wed Jun 5 10:16:47 UTC 2013 - cs@linux-administrator.com - fix permissions in cleanup cron script
[-] [+]	Changed	mod_security-ix.spec ^
@@ -2,8 +2,10 @@ Name: mod_security %if 0%{?centos_version} >= 6 \|\| 0%{?rhel_version} >= 600 \|\| 0%{?sl_version} >= 600 \|\| 0%{?suse_version} >= 1110 \|\| 0%{?sles_version} >= 11 %define pkgversion 2.7.4 +%define oldver 0 %else %define pkgversion 2.6.8 +%define oldver 1 %endif Version: %{pkgversion} Release: 35 @@ -25,6 +27,7 @@ Source6: modsec-clean_var-asl-data-audit Patch1: waf-label.patch Patch2: mlogc-disable-force-sslv3.patch +Patch50: CVE-2013-2765.patch BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) %if 0%{?rhel_version} \|\| 0%{?centos_version} \|\| 0%{?sl_version} \|\| 0%{?redhat_version} Requires: httpd httpd-mmn = %([ -a %{_includedir}/httpd/.mmn ] && cat %{_includedir}/httpd/.mmn \|\| echo missing) @@ -69,6 +72,9 @@ %setup -n modsecurity-apache_%{version} %patch1 -p1 %patch2 +%if 0%{?oldver} == 1 +%patch50 -p1 +%endif %build CFLAGS="%{optflags}"
[-] [+]	Added	CVE-2013-2765.patch ^
@@ -0,0 +1,10 @@ +--- modsecurity-apache_2.6.8/apache2/msc_reqbody.c.orig 2013-06-29 18:56:31.446864803 +0200 ++++ modsecurity-apache_2.6.8/apache2/msc_reqbody.c 2013-06-29 18:56:45.354863561 +0200 +@@ -170,6 +170,7 @@ + + /* Would storing this chunk mean going over the limit? / + if ((msr->msc_reqbody_spilltodisk) ++ && (msr->txcfg->reqbody_buffering != REQUEST_BODY_FORCEBUF_ON) + && (msr->msc_reqbody_length + length > (apr_size_t)msr->txcfg->reqbody_inmemory_limit)) + { + msc_data_chunk *chunks;