apr security update

2011-05-11T22:38:03
ID CESA-2011:0507
Type centos
Reporter CentOS Project
Modified 2011-05-11T22:46:40

Description

CentOS Errata and Security Advisory CESA-2011:0507

The Apache Portable Runtime (APR) is a portability library used by the Apache HTTP Server and other projects. It provides a free library of C data structures and routines.

It was discovered that the apr_fnmatch() function used an unconstrained recursion when processing patterns with the '*' wildcard. An attacker could use this flaw to cause an application using this function, which also accepted untrusted input as a pattern for matching (such as an httpd server using the mod_autoindex module), to exhaust all stack memory or use an excessive amount of CPU time when performing matching. (CVE-2011-0419)

Red Hat would like to thank Maksymilian Arciemowicz for reporting this issue.

All apr users should upgrade to these updated packages, which contain a backported patch to correct this issue. Applications using the apr library, such as httpd, must be restarted for this update to take effect.

Merged security bulletin from advisories: http://lists.centos.org/pipermail/centos-announce/2011-May/017553.html http://lists.centos.org/pipermail/centos-announce/2011-May/017554.html http://lists.centos.org/pipermail/centos-announce/2011-May/017555.html http://lists.centos.org/pipermail/centos-announce/2011-May/017556.html

Affected packages: apr apr-devel apr-docs

Upstream details at: https://rhn.redhat.com/errata/RHSA-2011-0507.html