CentOS Errata and Security Advisory CESA-2011:0507
The Apache Portable Runtime (APR) is a portability library used by the Apache HTTP Server and other projects. It provides a free library of C data structures and routines.
It was discovered that the apr_fnmatch() function used an unconstrained recursion when processing patterns with the '*' wildcard. An attacker could use this flaw to cause an application using this function, which also accepted untrusted input as a pattern for matching (such as an httpd server using the mod_autoindex module), to exhaust all stack memory or use an excessive amount of CPU time when performing matching. (CVE-2011-0419)
Red Hat would like to thank Maksymilian Arciemowicz for reporting this issue.
All apr users should upgrade to these updated packages, which contain a backported patch to correct this issue. Applications using the apr library, such as httpd, must be restarted for this update to take effect.
Merged security bulletin from advisories: http://lists.centos.org/pipermail/centos-announce/2011-May/029591.html http://lists.centos.org/pipermail/centos-announce/2011-May/029592.html http://lists.centos.org/pipermail/centos-announce/2011-May/029593.html http://lists.centos.org/pipermail/centos-announce/2011-May/029594.html
Affected packages: apr apr-devel apr-docs
Upstream details at: https://rhn.redhat.com/errata/RHSA-2011-0507.html