Summary: | <dev-libs/apr-1.4.5: Denial of Service in apr_fnmatch.c (regression from (CVE-2011-{0419,1928}) | ||
---|---|---|---|
Product: | Gentoo Security | Reporter: | Benedikt Böhm (RETIRED) <hollow> |
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
Status: | RESOLVED FIXED | ||
Severity: | minor | CC: | alexanderyt, apache-bugs, berto.d.sera, bug, max.gentoo.bugzilla |
Priority: | Normal | ||
Version: | unspecified | ||
Hardware: | All | ||
OS: | All | ||
URL: | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-1928 | ||
Whiteboard: | B3 [glsa] | ||
Package list: | Runtime testing required: | --- | |
Bug Depends on: | 385859 | ||
Bug Blocks: |
Description
Benedikt Böhm (RETIRED)
![]() From the changelog at http://www.apache.org/dist/apr/CHANGES-APR-1.4: Changes for APR 1.4.5 *) Security: CVE-2011-1928 apr_fnmatch(): Fix high CPU loop. [William Rowe] CVE-2011-1928 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1928): The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a denial of service (infinite loop) via a URI that does not match unspecified types of wildcard patterns, as demonstrated by attacks against mod_autoindex in httpd when a /*/WEB-INF/ configuration pattern is used. NOTE: this issue exists because of an incorrect fix for CVE-2011-0419. ebuild was already in tree for some time. Stabilization is requested in bug 385859. Added to existing draft. This issue was resolved and addressed in GLSA 201405-24 at http://security.gentoo.org/glsa/glsa-201405-24.xml by GLSA coordinator Sean Amoss (ackle). |