Commit Graph
8 Commits
Author SHA1 Message Date
Fabrice Fontaine fd952fa2c6 package/libmodsecurity: security bump to version 3.0.6
Support configurable limit on depth of JSON parsing (possible DoS issue)

https://github.com/SpiderLabs/ModSecurity/releases/tag/v3.0.6

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit d317b76458)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-11 23:39:12 +01:00
Giulio Benetti 0eac66e0e9 package/libmodsecurity: disable -fPIC on m68k_cf
This package has -fPIC gcc option set by default but we can't use it on
m68k_cf since it doesn't support it throwing a gcc build failure. So let's
disable it by passing -fno-PIC.

Fixes:
http://autobuild.buildroot.net/results/b92980a563fe7ee331e70f288ce041be0bf29d40/

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 2a48a6ee9d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-06 20:08:32 +02:00
Fabrice Fontaine 9e15ccc3e6 package/libmodsecurity: fix build with libmaxminddb
Build with libmaxminddb is broken since bump to version 3.0.5 in commit
464d0be380 because of
https://github.com/SpiderLabs/ModSecurity/commit/785958f9b5089b918c7d054cbcc2fe4a3c7b3788

So revert this commit until upstream answer to comment to
https://github.com/SpiderLabs/ModSecurity/issues/2131

Reverting this commit requires autoreconfiguring, which itself causes
lots of warnings as configure.ac queries git to know the version of
various parts of libmodsecurity. However, it turns out that those
versions are only used to be displayed in the output of the configure
script, which is quite useless. The only one that is referenced
elsewhere is LIBINJECTION_VERSION, but it's in fact a different thing:
it is defined by others/libinjection/src/libinjection_sqli.c.

The only variable that was AC_SUBST() and therefore visible elsewhere
was MSC_GIT_VERSION, but it is not used anywhere in the code base,
except in the configure script itself.

Note that one patch is 0001 and the other 0003, because there was
already a 0002 patch.

Fixes:
 - http://autobuild.buildroot.org/results/4c639fd967faa06f8ae362bacd38f3409c47267c

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 94b6fbd582)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-08-08 09:40:24 +02:00
Fabrice Fontaine 1d587d4789 package/libmodsecurity: security bump to version 3.0.5
Security Impacting Issues

    Handle URI received with uri-fragment
    [@martinhsv]

- Drop patches (already in version) and so drop autoreconf
- Static linking is supported since
  https://github.com/SpiderLabs/ModSecurity/commit/f76a1a667b8fdbcfe0d943daca9b41eb59cc61f3
- Update indentation in hash file (two spaces)

https://github.com/SpiderLabs/ModSecurity/releases/tag/v3.0.5

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 464d0be380)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-07-30 15:21:14 +02:00
Fabrice Fontaine aa6a494f2d package/libmodsecurity: drop AC_CHECK_FILE workaround
Drop AC_CHECK_FILE workaround as it is not needed since version 3.0.4:
https://github.com/SpiderLabs/ModSecurity/commit/8af8cad90779a64af87d29b3a44f3ea2e0a270c2

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 82f5293d73)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-07-30 15:21:09 +02:00
Fabrice Fontaine 87c9fd60d4 package/libmodsecurity: add CPE variables
cpe:2.3:a:trustwave:modsecurity is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Atrustwave%3Amodsecurity

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-03-06 11:18:24 +01:00
Frank Vanbever 788a7560cb package/libmodsecurity: point to staging pcre-config
The libmodsecurity build system uses the file installed on the host if not
explicitly pointed to pcre-config in the staging dir.

Fixes:
- http://autobuild.buildroot.net/results/f936ad05bca4bb776917306700750ba6d2498ef0
  + similar failures for other architectures

Signed-off-by: Frank Vanbever <frank.vanbever@essensium.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-02-01 10:26:29 +01:00
Frank Vanbever d9205b4da5 package/libmodsecurity: new package
The dependency on !BR2_STATIC_LIBS is due to missing Libs.private in the
libmodconfig pkg-config file making builds that statically link against
libmodsecurity fail.

Lua is disabled due to using the host libraries.

Yajl is disabled as enabling it forces the tests to be built. These tests have a
hard dependency on libmodsecurity.a which is not built when --disable-static is
used in the configuration. There is no flag to disable these tests.

Signed-off-by: Frank Vanbever <frank.vanbever@essensium.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-01-30 11:26:05 +01:00