kumquat-buildroot/package/modsecurity2/modsecurity2.hash

# From https://github.com/SpiderLabs/ModSecurity/releases/download/v2.9.5/modsecurity-2.9.5.tar.gz.sha256
sha256  e2bfc8cd8b8de1e21f054d310543373ea5d89adbd96784e832be0da3e4dc149e  modsecurity-2.9.5.tar.gz

# Locally computed
sha256  2c564f5a67e49e74c80e5a7dcacd1904e7408f1fd6a95218b38c04f012d94cb9  LICENSE
package/modsecurity2: security bump to version 2.9.5 - Fix CVE-2021-42717: ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web server being unable to service legitimate requests. Even a moderately large (e.g., 300KB) HTTP request can occupy one of the limited NGINX worker processes for minutes and consume almost all of the available CPU on the machine. Modsecurity 2 is similarly vulnerable: the affected versions include 2.8.0 through 2.9.4. - Use official tarball and so drop autoreconf Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> 2021-12-17 22:21:45 +01:00			`# From https://github.com/SpiderLabs/ModSecurity/releases/download/v2.9.5/modsecurity-2.9.5.tar.gz.sha256`
			`sha256 e2bfc8cd8b8de1e21f054d310543373ea5d89adbd96784e832be0da3e4dc149e modsecurity-2.9.5.tar.gz`

package/modsecurity2: new package The modsecurity2 package provides an Apache module implementing a web application firewall (WAF) module. Based on initial work from Tom Marcuzzi <tom.marcuzzi@orolia.com> and Nicolas Carrier <nicolas.carrier@orolia.com> modsecurity2 will be superseeded sooner or later by modsecurity v3 ie. libmodsecurity [1] and its Apache connector [2]. libmodsecurity is already supported in Buildroot with its Nginx connector. According to the Apache connector web page and the discussion [3], the Apache connector is not ready for production use. [1] https://github.com/SpiderLabs/ModSecurity [2] https://github.com/SpiderLabs/ModSecurity-apache [3] https://github.com/SpiderLabs/ModSecurity-apache/issues/80 The best we can do now is to still use modsecurity2 (v2.9.x) for Apache: https://github.com/SpiderLabs/ModSecurity/tree/v2/master Signed-off-by: Herve Codina <herve.codina@bootlin.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> 2021-10-18 15:25:31 +02:00			`# Locally computed`
			`sha256 2c564f5a67e49e74c80e5a7dcacd1904e7408f1fd6a95218b38c04f012d94cb9 LICENSE`