458617f635
- Fix CVE-2021-42717: ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web server being unable to service legitimate requests. Even a moderately large (e.g., 300KB) HTTP request can occupy one of the limited NGINX worker processes for minutes and consume almost all of the available CPU on the machine. Modsecurity 2 is similarly vulnerable: the affected versions include 2.8.0 through 2.9.4. - Use official tarball and so drop autoreconf Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
29 lines
974 B
Makefile
29 lines
974 B
Makefile
################################################################################
|
|
#
|
|
# modsecurity2
|
|
#
|
|
################################################################################
|
|
|
|
MODSECURITY2_VERSION = 2.9.5
|
|
MODSECURITY2_SOURCE = modsecurity-$(MODSECURITY2_VERSION).tar.gz
|
|
MODSECURITY2_SITE = https://github.com/SpiderLabs/ModSecurity/releases/download/v$(MODSECURITY2_VERSION)
|
|
MODSECURITY2_LICENSE = Apache-2.0
|
|
MODSECURITY2_LICENSE_FILES = LICENSE
|
|
MODSECURITY2_CPE_ID_VENDOR = trustwave
|
|
MODSECURITY2_CPE_ID_PRODUCT = modsecurity
|
|
MODSECURITY2_INSTALL_STAGING = YES
|
|
MODSECURITY2_DEPENDENCIES = apache libxml2 pcre
|
|
|
|
MODSECURITY2_CONF_OPTS = \
|
|
--with-pcre=$(STAGING_DIR)/usr/bin/pcre-config \
|
|
--with-libxml=$(STAGING_DIR)/usr \
|
|
--with-apr=$(STAGING_DIR)/usr/bin/apr-1-config \
|
|
--with-apu=$(STAGING_DIR)/usr/bin/apu-1-config \
|
|
--with-apxs=$(STAGING_DIR)/usr/bin/apxs \
|
|
--without-curl \
|
|
--without-lua \
|
|
--without-yajl \
|
|
--without-ssdeep
|
|
|
|
$(eval $(autotools-package))
|