Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-1.9.git;a=commitdiff;h=075afabcad05a4253d50f457916d285fab861de3
commit 075afabcad05a4253d50f457916d285fab861de3 Author: kikadf <[email protected]> Date: Mon Jun 2 14:20:37 2014 +0200 mod_wsgi-3.4-2arcturus1-x86_64 * Fix CVE-2014-0240 diff --git a/source/network-extra/mod_wsgi/CVE-2014-0240.patch b/source/network-extra/mod_wsgi/CVE-2014-0240.patch new file mode 100644 index 0000000..d892c17 --- /dev/null +++ b/source/network-extra/mod_wsgi/CVE-2014-0240.patch @@ -0,0 +1,36 @@ +From d9d5fea585b23991f76532a9b07de7fcd3b649f4 Mon Sep 17 00:00:00 2001 +From: Graham Dumpleton <[email protected]> +Date: Wed, 21 May 2014 16:16:47 +1000 +Subject: [PATCH] Local privilege escalation when using daemon mode. + (CVE-2014-0240) + +--- + mod_wsgi.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/mod_wsgi.c b/mod_wsgi.c +index 32b2903..3ef911b 100644 +--- a/mod_wsgi.c ++++ b/mod_wsgi.c +@@ -10756,6 +10756,19 @@ static void wsgi_setup_access(WSGIDaemonProcess *daemon) + ap_log_error(APLOG_MARK, WSGI_LOG_ALERT(errno), wsgi_server, + "mod_wsgi (pid=%d): Unable to change to uid=%ld.", + getpid(), (long)daemon->group->uid); ++ ++ /* ++ * On true UNIX systems this should always succeed at ++ * this point. With certain Linux kernel versions though ++ * we can get back EAGAIN where the target user had ++ * reached their process limit. In that case will be left ++ * running as wrong user. Just exit on all failures to be ++ * safe. Don't die immediately to avoid a fork bomb. ++ */ ++ ++ sleep(20); ++ ++ exit(-1); + } + } + +-- +1.9.3 diff --git a/source/network-extra/mod_wsgi/FrugalBuild b/source/network-extra/mod_wsgi/FrugalBuild index 01ac467..f3c8393 100644 --- a/source/network-extra/mod_wsgi/FrugalBuild +++ b/source/network-extra/mod_wsgi/FrugalBuild @@ -3,7 +3,7 @@ pkgname=mod_wsgi pkgver=3.4 -pkgrel=1 +pkgrel=2arcturus1 pkgdesc="Python WSGI adapter module for Apache." url="http://www.modpython.org/"; depends=('apache>=2.2.0' 'python>=2.7') @@ -16,6 +16,13 @@ source=($source mod_wsgi.conf) sha1sums=('92ebc48e60ab658a984f97fd40cb71e0ae895469' \ '0f1e505e724e6915ea0169980722d2411e608a3a') + +# FSA fix *** +source=(${source[@]} CVE-2014-0240.patch) +sha1sums=(${sha1sums[@]} '3c3685c827c4a8265ac7d044a656068ba25a75bf') +# *********** + + build() { Fbuild _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
