commit: 562e0ddc683696a4d4e423ed6b2b3a4f9d5d4eab Author: Kent Fredric <kentnl <AT> gentoo <DOT> org> AuthorDate: Tue May 12 18:01:03 2020 +0000 Commit: Kent Fredric <kentnl <AT> gentoo <DOT> org> CommitDate: Tue May 12 18:02:42 2020 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=562e0ddc
www-apache/mod_perl: Sec cleanup 2.0.11 re bug #672086 Removing versions affected by CVE-2011-2767 Bug: https://bugs.gentoo.org/672086 Bug: https://rt.cpan.org/Public/Bug/Display.html?id=126984 Bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=644169 Bug: https://bugzilla.redhat.com/show_bug.cgi?id=1623265 Bug: https://nvd.nist.gov/vuln/detail/CVE-2011-2767 Bug: https://www.cvedetails.com/cve/CVE-2011-2767/ Package-Manager: Portage-2.3.99, Repoman-2.3.22 Signed-off-by: Kent Fredric <kentnl <AT> gentoo.org> www-apache/mod_perl/Manifest | 1 - .../files/mod_perl-2.0.10-apache24-tests-1.patch | 33 ----- .../files/mod_perl-2.0.10-apache24-tests-2.patch | 23 ---- www-apache/mod_perl/mod_perl-2.0.10.ebuild | 140 --------------------- 4 files changed, 197 deletions(-) diff --git a/www-apache/mod_perl/Manifest b/www-apache/mod_perl/Manifest index c26064fe0a8..238175ecb66 100644 --- a/www-apache/mod_perl/Manifest +++ b/www-apache/mod_perl/Manifest @@ -1,2 +1 @@ -DIST mod_perl-2.0.10.tar.gz 3846211 BLAKE2B de44c76d22cc90984be20193bb635f27d68fbc25cab39333be93ee15c4636025d9e6d8f7bfc661b50ac19cfeb5f697f957acb7fbbb38e1f3f712c81ac27737ab SHA512 0bf1a885cb32a3393e95f87e71983097613e263b9052dbf22494663b506e36a25d0256afed24285232276d9f43ebd3adaa18b91129bfb62116a8ccb023855bca DIST mod_perl-2.0.11.tar.gz 3848147 BLAKE2B 8eeef6d1fadbf9d2e3bcff33c5114e588f032c2497f5191b1edd30da8bce72eadf5ea62482ec8ece7d7fde308c8c41d6682d1a325760c627bee75c3ce8cf6272 SHA512 f232b215ccb9217f69ccced8a037470e5975900b9a6fcc5a2e4674e6559d21f026547c1b97c48109352043946dc22539dd38004759be16ad5cfcb3a96973dfdf diff --git a/www-apache/mod_perl/files/mod_perl-2.0.10-apache24-tests-1.patch b/www-apache/mod_perl/files/mod_perl-2.0.10-apache24-tests-1.patch deleted file mode 100644 index 822fb4e8755..00000000000 --- a/www-apache/mod_perl/files/mod_perl-2.0.10-apache24-tests-1.patch +++ /dev/null @@ -1,33 +0,0 @@ -From f4dd0394f0975892b51a889f023d0e207553a656 Mon Sep 17 00:00:00 2001 -From: Niko Tyni <nt...@debian.org> -Date: Fri, 23 Dec 2016 18:27:23 +0200 -Subject: [PATCH 1/2] Fix t/apache/read.t HTTP syntax for Apache 2.4.25 - compatibility - -HTTP/1.1 RFC 7230, section 2.6. "Protocol Versioning" says the HTTP name -is case sensitive. Starting with Apache 2.4.25, using lower case will -make the server issue a 400 Bad request response, causing a test failure. - -https://tools.ietf.org/html/rfc7230#section-2.6 - -Bug-Debian: https://bugs.debian.org/849082 ---- - t/apache/read.t | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/t/apache/read.t b/t/apache/read.t -index 83670c9..9f7f504 100644 ---- a/t/apache/read.t -+++ b/t/apache/read.t -@@ -24,7 +24,7 @@ close $fh; - - my $size = length $data; - --for my $string ("POST $location http/1.0", -+for my $string ("POST $location HTTP/1.0", - "Content-length: $size", - "") { - my $line = "$string\r\n"; --- -2.11.0 - diff --git a/www-apache/mod_perl/files/mod_perl-2.0.10-apache24-tests-2.patch b/www-apache/mod_perl/files/mod_perl-2.0.10-apache24-tests-2.patch deleted file mode 100644 index 29e24cc770d..00000000000 --- a/www-apache/mod_perl/files/mod_perl-2.0.10-apache24-tests-2.patch +++ /dev/null @@ -1,23 +0,0 @@ -Author: Stefan Fritsch <s...@sfritsch.de> -Source: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=849082 - ---- ./t/filter/TestFilter/in_bbs_inject_header.pm.orig 2016-10-27 22:11:16.000000000 +0200 -+++ ./t/filter/TestFilter/in_bbs_inject_header.pm 2016-12-24 06:55:19.049606491 +0100 -@@ -181,7 +181,7 @@ - - if ($data and $data =~ /^POST/) { - # demonstrate how to add a header while processing other headers -- my $header = "$header1_key: $header1_val\n"; -+ my $header = "$header1_key: $header1_val\r\n"; - push @{ $ctx->{buckets} }, APR::Bucket->new($c->bucket_alloc, $header); - debug "queued header [$header]"; - } -@@ -199,7 +199,7 @@ - # we hit the headers and body separator, which is a good - # time to add extra headers: - for my $key (keys %headers) { -- my $header = "$key: $headers{$key}\n"; -+ my $header = "$key: $headers{$key}\r\n"; - push @{ $ctx->{buckets} }, APR::Bucket->new($c->bucket_alloc, $header); - debug "queued header [$header]"; - } diff --git a/www-apache/mod_perl/mod_perl-2.0.10.ebuild b/www-apache/mod_perl/mod_perl-2.0.10.ebuild deleted file mode 100644 index 9e6cfc0edf7..00000000000 --- a/www-apache/mod_perl/mod_perl-2.0.10.ebuild +++ /dev/null @@ -1,140 +0,0 @@ -# Copyright 1999-2020 Gentoo Authors -# Distributed under the terms of the GNU General Public License v2 - -EAPI=5 - -inherit depend.apache apache-module perl-module eutils - -DESCRIPTION="An embedded Perl interpreter for Apache2" -HOMEPAGE="https://perl.apache.org/ https://projects.apache.org/project.html?perl-mod_perl"; -SRC_URI="mirror://apache/perl/${P}.tar.gz" - -LICENSE="Apache-2.0" -SLOT="1" -KEYWORDS="~alpha amd64 ~arm ppc ppc64 x86" -IUSE="debug ithreads test" -RESTRICT="!test? ( test )" - -SRC_TEST=do - -# Apache::Reload, Apache::SizeLimit, and Apache::Test are force-unbundled. -# The minimum versions requested here are the bundled versions. - -# The test dependencies are from CPAN (Bundle::Apache2). - -# When all MPMs are disabled via useflags, the apache ebuild selects a -# default one, which will likely need threading. - -RDEPEND=" - dev-lang/perl[ithreads=] - >=dev-perl/Apache-Test-1.400.0 - >=www-servers/apache-2.0.47 - >=dev-libs/apr-util-1.4 - !ithreads? ( www-servers/apache[-apache2_mpms_event,-apache2_mpms_worker,apache2_mpms_prefork] ) -" -DEPEND="${RDEPEND} - dev-perl/Module-Build - test? ( - >=dev-perl/CGI-3.110.0 - dev-perl/Chatbot-Eliza - dev-perl/Devel-Symdump - dev-perl/HTML-Parser - dev-perl/IPC-Run3 - dev-perl/libwww-perl - www-servers/apache[apache2_modules_version,-apache2_modules_unique_id] - !www-apache/mpm_itk - ) -" -PDEPEND=" - >=dev-perl/Apache-Reload-0.130.0 - >=dev-perl/Apache-SizeLimit-0.970.0 -" - -APACHE2_MOD_FILE="${S}/src/modules/perl/mod_perl.so" -APACHE2_MOD_CONF="2.0.3/75_${PN}" -APACHE2_MOD_DEFINE="PERL" - -need_apache2 - -PATCHES=( - "${FILESDIR}/${PN}"-2.0.1-sneak-tmpdir.patch # seems to fix the make test problem - "${FILESDIR}/${PN}"-2.0.4-inline.patch # 550244 - "${FILESDIR}/${PN}"-2.0.10_rc1-bundled-Apache-Test.patch # 352724 - "${FILESDIR}/${PN}"-2.0.10_rc1-Gentoo-not-Unix.patch - "${FILESDIR}/${PN}"-2.0.10-apache24-tests-1.patch # 614684 - "${FILESDIR}/${PN}"-2.0.10-apache24-tests-2.patch # 614684 -) - -src_prepare() { - perl-module_src_prepare - - # chainsaw unbundling - rm -rf Apache-{Test,Reload,SizeLimit}/ lib/Bundle/ || die -} - -src_configure() { - local debug=$(usex debug 1 0) - local nothreads=$(usex ithreads 0 1) - myconf=( - MP_USE_DSO=1 - MP_APXS=${APXS} - MP_APR_CONFIG=/usr/bin/apr-1-config - MP_TRACE=${debug} - MP_DEBUG=${debug} - MP_NO_THREADS=${nothreads} - ) - - perl-module_src_configure -} - -src_test() { - # make test notes whether it is running as root, and drops - # privileges all the way to "nobody" if so, so we must adjust - # write permissions accordingly in this case. - - # IF YOU SUDO TO EMERGE AND HAVE !env_reset set testing will fail! - if [[ "$(id -u)" == "0" ]]; then - chown nobody:nobody "${WORKDIR}" "${T}" || die - fi - - # We force verbose tests for now to get meaningful bug reports. - MAKEOPTS+=" -j1" - TMPDIR="${T}" HOME="${T}/" TEST_VERBOSE=1 perl-module_src_test -} - -src_install() { - apache-module_src_install - - default - - perl_delete_localpod - perl_delete_packlist - - insinto "${APACHE_MODULES_CONFDIR}" - doins "${FILESDIR}"/2.0.3/apache2-mod_perl-startup.pl - - # this is an attempt to get @INC in line with /usr/bin/perl. - # there is blib garbage in the mainstream one that can only be - # useful during internal testing, so we wait until here and then - # just go with a clean slate. should be much easier to see what's - # happening and revert if problematic. - - perl_set_version - sed -i \ - -e "s,-I${S}/[^[:space:]\"\']\+[[:space:]]\?,,g" \ - -e "s,-typemap[[:space:]]${S}/[^[:space:]\"\']\+[[:space:]]\?,,g" \ - -e "s,${S}\(/[^[:space:]\"\']\+\)\?,/,g" \ - "${D}/${VENDOR_ARCH}/Apache2/BuildConfig.pm" || die - - local fname - for fname in $(find "${D}" -type f -not -name '*.so'); do - grep -q "\(${D}\|${S}\)" "${fname}" && ewarn "QA: File contains a temporary path ${fname}" - sed -i -e "s:\(${D}\|${S}\):/:g" ${fname} || die - done - - perl_remove_temppath -} - -pkg_postinst() { - apache-module_pkg_postinst -}
