summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--debian/changelog5
-rw-r--r--debian/patches/100-svn-XSS-Status.patch50
-rw-r--r--debian/patches/series1
3 files changed, 56 insertions, 0 deletions
diff --git a/debian/changelog b/debian/changelog
index f759419..8a1eed9 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -8,6 +8,11 @@ libapache2-mod-perl2 (2.0.4-6) UNRELEASED; urgency=low
* docs/index_top.html: Issued patch 099-fix-url-on-index_top.patch
to fix link URL. (Closes: #507606)
+ [ Damyan Ivanov ]
+ * add 100-svn-XSS-Status.patch; fixes XSS in Apache2::Status (CVE-2009-0796)
+ Patch taken from r760926 of upstream SVN.
+ Closes: #567635
+
-- Dario Minnucci <midget@debian.org> Wed, 13 Jan 2010 08:42:40 +0100
libapache2-mod-perl2 (2.0.4-5) unstable; urgency=low
diff --git a/debian/patches/100-svn-XSS-Status.patch b/debian/patches/100-svn-XSS-Status.patch
new file mode 100644
index 0000000..4065120
--- /dev/null
+++ b/debian/patches/100-svn-XSS-Status.patch
@@ -0,0 +1,50 @@
+# Description: Fix XSS in Apache2::Status (CVE-2009-0796)
+# Origin: http://svn.apache.org/viewvc/perl/modperl/trunk/lib/Apache2/Status.pm?r1=607697&r2=760926&pathrev=761081&view=patch
+# Bug-Debian: 567635
+--- a/lib/Apache2/Status.pm
++++ b/lib/Apache2/Status.pm
+@@ -29,7 +29,7 @@ use File::Spec ();
+
+ use Apache2::Const -compile => qw(OK);
+
+-$Apache2::Status::VERSION = '4.00'; # mod_perl 2.0
++$Apache2::Status::VERSION = '4.01'; # mod_perl 2.0
+
+ use constant IS_WIN32 => ($^O eq "MSWin32");
+
+@@ -126,7 +126,7 @@ sub handler {
+ $r->print(symdump($r, $qs));
+ }
+ else {
+- my $uri = $r->uri;
++ my $uri = $r->location;
+ $r->print('<p>');
+ $r->print(
+ map { qq[<a href="$uri?$_">$status{$_}</a><br />\n] } sort { lc $a cmp lc $b } keys %status
+@@ -198,7 +198,7 @@ sub status_section_config {
+ sub status_inc {
+ my ($r) = @_;
+
+- my $uri = $r->uri;
++ my $uri = $r->location;
+ my @retval = (
+ '<table border="1">',
+ "<tr>",
+@@ -289,7 +289,7 @@ sub status_rgysubs {
+ my ($r) = @_;
+
+ local $_;
+- my $uri = $r->uri;
++ my $uri = $r->location;
+ my $cache = __PACKAGE__->registry_cache;
+
+ my @retval = "<h2>Compiled registry scripts grouped by their handler</h2>";
+@@ -765,7 +765,7 @@ sub as_HTML {
+ my ($self, $package, $r) = @_;
+
+ my @m = qw(<table>);
+- my $uri = $r->uri;
++ my $uri = $r->location;
+ my $is_main = $package eq "main";
+
+ my $do_dump = has($r, "dumper");
diff --git a/debian/patches/series b/debian/patches/series
index 017c380..74823b0 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -7,3 +7,4 @@
030-apxs-no-prefix.patch
031-test-extra-args.patch
035-testrequest_add_credentials.patch
+100-svn-XSS-Status.patch