add apache2-mod_security2-CVE-2025-54571.patch

- version update to 2.9.11 [bsc#1245620] (CVE-2025-52891)
  * fix: prevent segmentation fault if the XML node is empty
  * Plug memory leak when msre_op_validateSchema_execute() exits normally (validateSchema)
  * chore: bump version in MSI installer.wxs
  * Fix resource leaks in `msc_status_engine_mac_address`
- modified patches
  % apache2-mod_security2-no_rpath.diff (refreshed)
  % modsecurity-fixes.patch (refreshed)

OBS-URL: https://build.opensuse.org/request/show/1290193
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/apache2-mod_security2?expand=0&rev=36

README-SUSE-mod_security2.txt

@@ -1,13 +0,0 @@
-
-#
-# Dear Administrator,
-#
-# mod_security2 is not activated by default upon installation of the
-# apache module.
-#
-# Your starting point for the configuration of mod_security2 is
-# /etc/apache2/conf.d/mod_security2.conf .
-# Please see that file for comments on how to activate the module
-# and on how to assign rules.
-#
-

SpiderLabs-owasp-modsecurity-crs-2.2.9-5-gebe8790.tar.gz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:637b53696e96f3855f8d4bc678dd67dc8a4ba1ce7da418dafc74524cbf36c92a
-size 291337

apache2-mod_security2-CVE-2025-54571.patch

@@ -0,0 +1,236 @@
+From dfbde557acc41d858dbe04d4b6eaec64478347ff Mon Sep 17 00:00:00 2001
+From: Ervin Hegedus <airween@gmail.com>
+Date: Wed, 30 Jul 2025 10:55:33 +0200
+Subject: [PATCH] Fix invalid request handling
+
+---
+ apache2/apache2_io.c    | 48 +++++++++++++++++-----------------
+ apache2/mod_security2.c | 57 ++++++-----------------------------------
+ 2 files changed, 32 insertions(+), 73 deletions(-)
+
+Index: modsecurity-v2.9.11/apache2/apache2_io.c
+===================================================================
+--- modsecurity-v2.9.11.orig/apache2/apache2_io.c
++++ modsecurity-v2.9.11/apache2/apache2_io.c
+@@ -192,27 +192,29 @@ apr_status_t read_request_body(modsec_re
+         if (msr->txcfg->debuglog_level >= 4) {
+             msr_log(msr, 4, "Input filter: This request does not have a body.");
+         }
+-        return 0;
++        return APR_SUCCESS;
+     }
+ 
+     if (msr->txcfg->reqbody_access != 1) {
+         if (msr->txcfg->debuglog_level >= 4) {
+             msr_log(msr, 4, "Input filter: Request body access not enabled.");
+         }
+-        return 0;
++        return APR_SUCCESS;
+     }
+ 
+     if (msr->txcfg->debuglog_level >= 4) {
+         msr_log(msr, 4, "Input filter: Reading request body.");
+     }
+     if (modsecurity_request_body_start(msr, error_msg) < 0) {
+-        return -1;
++        return HTTP_INTERNAL_SERVER_ERROR;
+     }
+ 
+     finished_reading = 0;
+     msr->if_seen_eos = 0;
+     bb_in = apr_brigade_create(msr->mp, r->connection->bucket_alloc);
+-    if (bb_in == NULL) return -1;
++    if (bb_in == NULL) {
++        return HTTP_INTERNAL_SERVER_ERROR;
++    }
+     do {
+         apr_status_t rc;
+ 
+@@ -224,27 +226,19 @@ apr_status_t read_request_body(modsec_re
+             switch(rc) {
+                 case AP_FILTER_ERROR :
+                     *error_msg = apr_pstrdup(msr->mp, "Error reading request body: filter error");
+-                    return -8;
++                    break;
+ 
+-                case APR_INCOMPLETE :
+-                    *error_msg = apr_psprintf(msr->mp, "Error reading request body: %s", get_apr_error(msr->mp, rc));
+-                    return -7;
+-                case APR_EOF :
+-                    *error_msg = apr_psprintf(msr->mp, "Error reading request body: %s", get_apr_error(msr->mp, rc));
+-                    return -6;
+-                case APR_TIMEUP :
+-                    *error_msg = apr_psprintf(msr->mp, "Error reading request body: %s", get_apr_error(msr->mp, rc));
+-                    return -4;
+                 case APR_ENOSPC:
+                     *error_msg = apr_psprintf(msr->mp, "Error reading request body: HTTP Error 413 - Request entity too large. (Most likely.)");
+-                    return -3;
++                    break;
+                 case APR_EGENERAL :
+                     *error_msg = apr_psprintf(msr->mp, "Error reading request body: Client went away.");
+-                    return -2;
++                    break;
+                 default :
+                     *error_msg = apr_psprintf(msr->mp, "Error reading request body: %s", get_apr_error(msr->mp, rc));
+-                    return -1;
++                    break;
+             }
++            return ap_map_http_request_error(rc, HTTP_BAD_REQUEST);
+         }
+ 
+         /* Loop through the buckets in the brigade in order
+@@ -260,7 +254,7 @@ apr_status_t read_request_body(modsec_re
+             rc = apr_bucket_read(bucket, &buf, &buflen, APR_BLOCK_READ);
+             if (rc != APR_SUCCESS) {
+                 *error_msg = apr_psprintf(msr->mp, "Failed reading input / bucket (%d): %s", rc, get_apr_error(msr->mp, rc));
+-                return -1;
++                return HTTP_INTERNAL_SERVER_ERROR;
+             }
+ 
+             if (msr->txcfg->debuglog_level >= 9) {
+@@ -273,7 +267,7 @@ apr_status_t read_request_body(modsec_re
+                 if((msr->txcfg->is_enabled == MODSEC_ENABLED) && (msr->txcfg->if_limit_action == REQUEST_BODY_LIMIT_ACTION_REJECT)) {
+                     *error_msg = apr_psprintf(msr->mp, "Request body is larger than the "
+                             "configured limit (%ld).", msr->txcfg->reqbody_limit);
+-                    return -5;
++                    return HTTP_REQUEST_ENTITY_TOO_LARGE;
+                 } else if((msr->txcfg->is_enabled == MODSEC_ENABLED) && (msr->txcfg->if_limit_action == REQUEST_BODY_LIMIT_ACTION_PARTIAL)) {
+ 
+                     *error_msg = apr_psprintf(msr->mp, "Request body is larger than the "
+@@ -294,7 +288,7 @@ apr_status_t read_request_body(modsec_re
+                     *error_msg = apr_psprintf(msr->mp, "Request body is larger than the "
+                             "configured limit (%ld).", msr->txcfg->reqbody_limit);
+ 
+-                    return -5;
++                    return HTTP_REQUEST_ENTITY_TOO_LARGE;
+                 }
+             }
+ 
+@@ -304,7 +298,7 @@ apr_status_t read_request_body(modsec_re
+                 modsecurity_request_body_to_stream(msr, buf, buflen, error_msg);
+ #else
+                 if (modsecurity_request_body_to_stream(msr, buf, buflen, error_msg) < 0) {
+-                    return -1;
++                    return HTTP_INTERNAL_SERVER_ERROR;
+                 }
+ #endif
+             }
+@@ -323,7 +317,7 @@ apr_status_t read_request_body(modsec_re
+                         if((msr->txcfg->is_enabled == MODSEC_ENABLED) && (msr->txcfg->if_limit_action == REQUEST_BODY_LIMIT_ACTION_REJECT)) {
+                             *error_msg = apr_psprintf(msr->mp, "Request body no files data length is larger than the "
+                                     "configured limit (%ld).", msr->txcfg->reqbody_no_files_limit);
+-                            return -5;
++                            return HTTP_REQUEST_ENTITY_TOO_LARGE;
+                         } else if ((msr->txcfg->is_enabled == MODSEC_ENABLED) && (msr->txcfg->if_limit_action == REQUEST_BODY_LIMIT_ACTION_PARTIAL)) {
+                             *error_msg = apr_psprintf(msr->mp, "Request body no files data length is larger than the "
+                                     "configured limit (%ld).", msr->txcfg->reqbody_no_files_limit);
+@@ -333,12 +327,12 @@ apr_status_t read_request_body(modsec_re
+                         } else {
+                             *error_msg = apr_psprintf(msr->mp, "Request body no files data length is larger than the "
+                                     "configured limit (%ld).", msr->txcfg->reqbody_no_files_limit);
+-                            return -5;
++                            return HTTP_REQUEST_ENTITY_TOO_LARGE;
+                         }
+                     }
+ 
+                     if((msr->txcfg->is_enabled == MODSEC_ENABLED) && (msr->txcfg->if_limit_action == REQUEST_BODY_LIMIT_ACTION_REJECT))
+-                        return -1;
++                        return HTTP_INTERNAL_SERVER_ERROR;
+                 }
+ 
+             }
+@@ -361,7 +355,13 @@ apr_status_t read_request_body(modsec_re
+ 
+     msr->if_status = IF_STATUS_WANTS_TO_RUN;
+ 
+-    return rcbe;
++    if (rcbe == -5) {
++        return HTTP_REQUEST_ENTITY_TOO_LARGE;
++    }
++    if (rcbe < 0) {
++        return HTTP_INTERNAL_SERVER_ERROR;
++    }
++    return APR_SUCCESS;
+ }
+ 
+ 
+Index: modsecurity-v2.9.11/apache2/mod_security2.c
+===================================================================
+--- modsecurity-v2.9.11.orig/apache2/mod_security2.c
++++ modsecurity-v2.9.11/apache2/mod_security2.c
+@@ -1032,64 +1032,18 @@ static int hook_request_late(request_rec
+     }
+ 
+     rc = read_request_body(msr, &my_error_msg);
+-    if (rc < 0) {
+-        switch(rc) {
+-            case -1 :
+-                if (my_error_msg != NULL) {
+-                    msr_log(msr, 1, "%s", my_error_msg);
+-                }
+-                return HTTP_INTERNAL_SERVER_ERROR;
+-                break;
+-            case -2 : /* Bad request. */
+-            case -6 : /* EOF when reading request body. */
+-            case -7 : /* Partial recieved */
+-                if (my_error_msg != NULL) {
+-                    msr_log(msr, 4, "%s", my_error_msg);
+-                }
+-                r->connection->keepalive = AP_CONN_CLOSE;
+-                return HTTP_BAD_REQUEST;
+-                break;
+-            case -3 : /* Apache's LimitRequestBody. */
+-                if (my_error_msg != NULL) {
+-                    msr_log(msr, 1, "%s", my_error_msg);
+-                }
+-                return HTTP_REQUEST_ENTITY_TOO_LARGE;
+-                break;
+-            case -4 : /* Timeout. */
+-                if (my_error_msg != NULL) {
+-                    msr_log(msr, 4, "%s", my_error_msg);
+-                }
+-                r->connection->keepalive = AP_CONN_CLOSE;
+-                return HTTP_REQUEST_TIME_OUT;
+-                break;
+-            case -5 : /* Request body limit reached. */
+-                msr->inbound_error = 1;
+-                if((msr->txcfg->is_enabled == MODSEC_ENABLED) && (msr->txcfg->if_limit_action == REQUEST_BODY_LIMIT_ACTION_REJECT))    {
+-                    r->connection->keepalive = AP_CONN_CLOSE;
+-                    if (my_error_msg != NULL) {
+-                        msr_log(msr, 1, "%s. Deny with code (%d)", my_error_msg, HTTP_REQUEST_ENTITY_TOO_LARGE);
+-                    }
+-                    return HTTP_REQUEST_ENTITY_TOO_LARGE;
+-                } else  {
+-                    if (my_error_msg != NULL) {
+-                        msr_log(msr, 1, "%s", my_error_msg);
+-                    }
+-                }
+-                break;
+-            case -8 : /* Filter error. */
+-                if (my_error_msg != NULL) {
+-                    msr_log(msr, 1, "%s", my_error_msg);
+-                }
+-                return AP_FILTER_ERROR;
+-                break;
+-            default :
+-                /* allow through */
+-                break;
+-        }
+ 
+-        msr->msc_reqbody_error = 1;
+-        msr->msc_reqbody_error_msg = my_error_msg;
+-    }
++    if (rc != OK) {
++        if (my_error_msg != NULL) {
++            msr_log(msr, 1, "%s", my_error_msg);
++         }
++
++        if (rc == HTTP_REQUEST_ENTITY_TOO_LARGE) {
++            msr->inbound_error = 1;
++        }
++        r->connection->keepalive = AP_CONN_CLOSE;
++        return rc;
++     }
+ 
+     /* Update the request headers. They might have changed after
+      * the body was read (trailers).

apache2-mod_security2-gcc14.patch

@@ -1,35 +0,0 @@
-Index: modsecurity-2.9.7/tests/msc_test.c
-===================================================================
---- modsecurity-2.9.7.orig/tests/msc_test.c
-+++ modsecurity-2.9.7/tests/msc_test.c
-@@ -81,7 +81,7 @@ char DSOLOCAL *real_server_signature = N
- int DSOLOCAL remote_rules_fail_action = REMOTE_RULES_ABORT_ON_FAIL;
- char DSOLOCAL *remote_rules_fail_message = NULL;
- module AP_MODULE_DECLARE_DATA security2_module = {
--    NULL,
-+    STANDARD20_MODULE_STUFF,
-     NULL,
-     NULL,
-     NULL,
-Index: modsecurity-2.9.7/standalone/config.c
-===================================================================
---- modsecurity-2.9.7.orig/standalone/config.c
-+++ modsecurity-2.9.7/standalone/config.c
-@@ -989,7 +989,7 @@ AP_DECLARE(const char *) process_fnmatch
-         const char *rootpath, *filepath = fname;
- 
-         /* locate the start of the directories proper */
--        status = apr_filepath_root(&rootpath, &filepath, APR_FILEPATH_TRUENAME | APR_FILEPATH_NATIVE, ptemp);
-+        status = apr_filepath_root((const char **) &rootpath, (const char **) &filepath, APR_FILEPATH_TRUENAME | APR_FILEPATH_NATIVE, ptemp);
- 
-         /* we allow APR_SUCCESS and APR_EINCOMPLETE */
-         if (APR_ERELATIVE == status) {
-@@ -1104,7 +1104,7 @@ ProcessInclude:
- 				incpath = w;
- 
- 				/* locate the start of the directories proper */
--				status = apr_filepath_root(&rootpath, &incpath, APR_FILEPATH_TRUENAME | APR_FILEPATH_NATIVE, ptemp);
-+				status = apr_filepath_root((const char**) &rootpath, (const char **) &incpath, APR_FILEPATH_TRUENAME | APR_FILEPATH_NATIVE, ptemp);
- 
- 				/* we allow APR_SUCCESS and APR_EINCOMPLETE */
- 				if (APR_ERELATIVE == status) {

apache2-mod_security2.changes

@@ -1,3 +1,11 @@
+-------------------------------------------------------------------
+Fri Aug 22 09:51:44 UTC 2025 - pgajdos@suse.com
+
+- security update
+- added patches
+  CVE-2025-54571 [bsc#1247674], Insufficient Return Value Handling on ModSecurity leads to XSS and Source Code Disclosure
+  + apache2-mod_security2-CVE-2025-54571.patch
+
 -------------------------------------------------------------------
 Thu Jul  3 11:13:07 UTC 2025 - pgajdos@suse.com
 

apache2-mod_security2.spec

@@ -34,6 +34,8 @@ Patch1:         modsecurity-fixes.patch
 Patch2:         apache2-mod_security2_tests_conf.patch
 # https://github.com/SpiderLabs/ModSecurity/issues/2514
 Patch3:         modsecurity-2.9.3-input_filtering_errors.patch
+# CVE-2025-54571 [bsc#1247674], Insufficient Return Value Handling on ModSecurity leads to XSS and Source Code Disclosure
+Patch4:         apache2-mod_security2-CVE-2025-54571.patch
 BuildRequires:  apache-rpm-macros
 BuildRequires:  apache2-devel
 BuildRequires:  apache2-prefork

empty.conf

@@ -1,4 +0,0 @@
-# This configuration file has been intentionally left empty to avoid errors
-# resulting from an Include statement that matches no files.
-# (IncludeOptional is available for apache > 2.4)
-#

modsecurity-2.9.7.tar.gz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:2a28fcfccfef21581486f98d8d5fe0397499749b8380f60ec7bb1c08478e1839
-size 4320766

modsecurity-v2.9.10.tar.gz.asc

@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABCgAdFiEECyuhkkBltEaRICoq0obgIhSfD24FAmg9vdIACgkQ0obgIhSf
-D26E+A/9EyKVITZQ7/LvBOe+ekk1ZNh2szD4asjPMqSGMazRPlSYXbLn0UWLRoXW
-R2HpLcp2wCM9wmyun6vQoN75B+hTvZU8FcIAqUrqDLFRHgd3NJA7g1Sdi87QfLPu
-n/adQhWtROCFOQlzz7ByY2jrqj/OwgXydcfB3y/9WtjBCMOXNnZGYPQzPq4p0jxw
-ZnVj4YQQ0PIJM4cOJ6JOc9Jfnh0D4E7b9Nx7QtRaiirwv3L+WruPxuMB3sLsAKun
-7X/DUo7g4FFYHMC8ssxWIKJ58dAmOYCnZIXmaUl+V8zDadEKDu3sR2Gi1TzjCoAO
-xnMhrLaz3vMsdlhgGEeBGb8Qh9htCpO4twXt0u+9GZqojTK3W1XRbbFCETtBgvsn
-rn7AzaPwrRoQHl5JWB9Uyx0KrLJKyf2ASpOWP3ilC+FDl5Y/T8uyQ3C+d/ug3jyn
-WocfC9b2Ot9D+Fgn9FsIbsksVmovEvqn4q8RSNHvyPhf2oCiCuKdcHI8BULcSw4/
-MVcU4hBbkNjkTPD2AOwjx/6kTiZ+b8O+dki2UvvZLluRy7eTUe5ESYAL/VvMQjYC
-xqCHr2wDC0MSKt5yGP24om5Kn4X8egJcx2BUiVIMQMnuHzBiFkzsq5o2u2AlKWeV
-Gd3AVPbVjrKunGzC8i82QVmLCyL1jweiIHXcEr2ieeGzm4vRlEg=
-=idKc
------END PGP SIGNATURE-----

modsecurity-v2.9.8.tar.gz.asc

@@ -1,16 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQIzBAABCgAdFiEECyuhkkBltEaRICoq0obgIhSfD24FAmbXB9IACgkQ0obgIhSf
-D24nAA//aT21bY/w4MWg72yhXoi0GzcsZ6JU1HwWH3Y+NYfHcmgnwH1FkLdZSGM0
-P9iZE6HCphqSEctm7oHrKzzUAfvdJo+Qv1dKxFAYf7MT4IPfCH2JGXM5IfW6Nx9S
-7dh37kR53x0a9oj9n2+m8jWVbCr8yW4t2bOsmLHH6eBqSKAMYNI01wOhH+4kexVH
-d56CVIeZ2RmoT6t0KwnsBoLOFHFOr+sHCowlsjvHVB74r/c6bx5uDok6FVbCmEKI
-ettqURJerKrqfR9L145pqjJXPuCZJuYDDm905CfsdnTmNs4v7Hgimo9n2BLARtHf
-tG+SEpUxotMLEA2ZE6W+cd/AM2nIIJ/TvY/S3XBDb7mmQW33A6wopJ7tu2XZ5SJJ
-Nw5n5v9x3K6UYU/NgjdHbgGxy9TVFqSYaAqSrVUVIz2GpM6Oj0wJ9f1Wtj+v9iim
-FYO/dXta29D91RT/0SShX1GAfpt8220zDEX0T+6J71znKzPH5+5Cr+UoDLmIR35t
-EVbKcGMZW/6hL1mUyHFbjJgKnhFtRoMPuXUSXPWRjfc3HekwrKQmT8oDfkhdqP+Y
-WxNspOGyUjKchUvrnnSkZnlGZSPXamFQ7/DLWNFp3P/aT0NkRSa8S0mLvAmRxY51
-HiMAP+AQcsUcLAw0z5Lh7d52UJzYdMaBfs+p+j5GC05qflBpetY=
-=oDiC
------END PGP SIGNATURE-----