apr security update

ID CESA-2011:0507
Type centos
Reporter CentOS Project
Modified 2011-05-12T02:46:40


CentOS Errata and Security Advisory CESA-2011:0507

The Apache Portable Runtime (APR) is a portability library used by the Apache HTTP Server and other projects. It provides a free library of C data structures and routines.

It was discovered that the apr_fnmatch() function used an unconstrained recursion when processing patterns with the '*' wildcard. An attacker could use this flaw to cause an application using this function, which also accepted untrusted input as a pattern for matching (such as an httpd server using the mod_autoindex module), to exhaust all stack memory or use an excessive amount of CPU time when performing matching. (CVE-2011-0419)

Red Hat would like to thank Maksymilian Arciemowicz for reporting this issue.

All apr users should upgrade to these updated packages, which contain a backported patch to correct this issue. Applications using the apr library, such as httpd, must be restarted for this update to take effect.

Merged security bulletin from advisories: http://lists.centos.org/pipermail/centos-announce/2011-May/029591.html http://lists.centos.org/pipermail/centos-announce/2011-May/029592.html http://lists.centos.org/pipermail/centos-announce/2011-May/029593.html http://lists.centos.org/pipermail/centos-announce/2011-May/029594.html

Affected packages: apr apr-devel apr-docs

Upstream details at: https://rhn.redhat.com/errata/RHSA-2011-0507.html