diff --git a/4.9.1.tar.gz b/4.9.1.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..bafeed2562e7287db362098b3964ae7e2d047b3e Binary files /dev/null and b/4.9.1.tar.gz differ diff --git a/CVE-2022-2255.patch b/CVE-2022-2255.patch index 30e9014a84820ceb873d83a6f933ace073bf7fce..713316f19f9c8fd8d91d57ab0e456520a2434104 100644 --- a/CVE-2022-2255.patch +++ b/CVE-2022-2255.patch @@ -1,11 +1,11 @@ -diff -Nur mod_wsgi-4.6.4.old/src/server/mod_wsgi.c mod_wsgi-4.6.4/src/server/mod_wsgi.c ---- mod_wsgi-4.6.4.old/src/server/mod_wsgi.c 2022-08-08 15:27:04.978005420 +0800 -+++ mod_wsgi-4.6.4/src/server/mod_wsgi.c 2022-08-08 15:30:20.395491862 +0800 -@@ -13897,6 +13897,7 @@ - value = apr_table_get(r->subprocess_env, name); +diff -Nur mod_wsgi-4.9.1.old/src/server/mod_wsgi.c mod_wsgi-4.9.1/src/server/mod_wsgi.c +--- mod_wsgi-4.9.1.old/src/server/mod_wsgi.c 2022-08-08 10:12:40.044127804 +0800 ++++ mod_wsgi-4.9.1/src/server/mod_wsgi.c 2022-08-08 10:14:21.532845853 +0800 +@@ -14044,6 +14044,7 @@ + name = ((const char**)trusted_proxy_headers->elts)[i]; if (!strcmp(name, "HTTP_X_FORWARDED_FOR") || -+ !strcmp(name, "HTTP_X_CLIENT_IP") || ++ !strcmp(name, "HTTP_X_CLIENT_IP") || !strcmp(name, "HTTP_X_REAL_IP")) { match_client_header = 1; diff --git a/Changed-functions-to-pre-post-actions-when-forking.patch b/Changed-functions-to-pre-post-actions-when-forking.patch deleted file mode 100644 index 91c47fc6974c2740a0daaa2d0e2c0379cc862be4..0000000000000000000000000000000000000000 --- a/Changed-functions-to-pre-post-actions-when-forking.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 0f34844009075391c55419a3afb90e469facf35e Mon Sep 17 00:00:00 2001 -From: Graham Dumpleton -Date: Tue, 14 May 2019 16:14:07 +1000 -Subject: [PATCH] Changed functions to pre/post actions when forking. - ---- - src/server/mod_wsgi.c | 13 ++++++++++++- - 1 file changed, 12 insertions(+), 1 deletion(-) - -diff --git a/src/server/mod_wsgi.c b/src/server/mod_wsgi.c -index 2e4bb24d..bf55945a 100644 ---- a/src/server/mod_wsgi.c -+++ b/src/server/mod_wsgi.c -@@ -4345,8 +4345,13 @@ static void wsgi_python_child_init(apr_pool_t *p) - * do it if Python was initialised in parent process. - */ - -- if (wsgi_python_initialized && !wsgi_python_after_fork) -+ if (wsgi_python_initialized && !wsgi_python_after_fork) { -+#if PY_MAJOR_VERSION > 3 || (PY_MAJOR_VERSION == 3 && PY_MINOR_VERSION >= 7) -+ PyOS_AfterFork_Child(); -+#else - PyOS_AfterFork(); -+#endif -+ } - - /* Finalise any Python objects required by child process. */ - -@@ -10422,6 +10427,12 @@ static int wsgi_start_process(apr_pool_t *p, WSGIDaemonProcess *daemon) - wsgi_exit_daemon_process(0); - } - -+ if (wsgi_python_initialized) { -+#if PY_MAJOR_VERSION > 3 || (PY_MAJOR_VERSION == 3 && PY_MINOR_VERSION >= 7) -+ PyOS_AfterFork_Parent(); -+#endif -+ } -+ - apr_pool_note_subprocess(p, &daemon->process, APR_KILL_AFTER_TIMEOUT); - apr_proc_other_child_register(&daemon->process, wsgi_manage_process, - daemon, NULL, p); diff --git a/Use-official-APIs-for-accessing-interpreter-list.patch b/Use-official-APIs-for-accessing-interpreter-list.patch deleted file mode 100644 index c2c99910d4056c030d52a97312e05f044c9372a8..0000000000000000000000000000000000000000 --- a/Use-official-APIs-for-accessing-interpreter-list.patch +++ /dev/null @@ -1,55 +0,0 @@ -From b03b02df6318afe26052db5b0365732152cacea2 Mon Sep 17 00:00:00 2001 -From: Graham Dumpleton -Date: Tue, 14 May 2019 16:14:42 +1000 -Subject: [PATCH] Use official APIs for accessing interpreter list. - ---- - src/server/wsgi_interp.c | 18 ++++++++++++------ - 1 file changed, 12 insertions(+), 6 deletions(-) - -diff --git a/src/server/wsgi_interp.c b/src/server/wsgi_interp.c -index 4a948509..3fbca04b 100644 ---- a/src/server/wsgi_interp.c -+++ b/src/server/wsgi_interp.c -@@ -338,9 +338,10 @@ static PyObject *ShutdownInterpreter_call( - - PyThreadState_Swap(NULL); - -- tstate = tstate->interp->tstate_head; -+ tstate = PyInterpreterState_ThreadHead(tstate->interp); -+ - while (tstate) { -- tstate_next = tstate->next; -+ tstate_next = PyThreadState_Next(tstate); - if (tstate != tstate_save) { - PyThreadState_Swap(tstate); - PyThreadState_Clear(tstate); -@@ -436,9 +437,13 @@ InterpreterObject *newInterpreterObject(const char *name) - */ - - if (!name) { -+#if PY_MAJOR_VERSION > 3 || (PY_MAJOR_VERSION == 3 && PY_MINOR_VERSION >= 7) -+ interp = PyInterpreterState_Main(); -+#else - interp = PyInterpreterState_Head(); -- while (interp->next) -- interp = interp->next; -+ while (PyInterpreterState_Next(interp)) -+ interp = PyInterpreterState_Next(interp); -+#endif - - name = ""; - } -@@ -1883,9 +1888,10 @@ static void Interpreter_dealloc(InterpreterObject *self) - - PyThreadState_Swap(NULL); - -- tstate = tstate->interp->tstate_head; -+ tstate = PyInterpreterState_ThreadHead(tstate->interp); -+ - while (tstate) { -- tstate_next = tstate->next; -+ tstate_next = PyThreadState_Next(tstate); - if (tstate != tstate_save) { - PyThreadState_Swap(tstate); - PyThreadState_Clear(tstate); diff --git a/mod_wsgi-4.6.4.tar.gz b/mod_wsgi-4.6.4.tar.gz deleted file mode 100644 index f882d337fd4e9e8cdfbec0c6073b6673486b608c..0000000000000000000000000000000000000000 Binary files a/mod_wsgi-4.6.4.tar.gz and /dev/null differ diff --git a/mod_wsgi.spec b/mod_wsgi.spec index 6e3e9e06d242515b54c8c7f3ffe28eda8941a73c..7b7bb2b956835a809908e01cc9c3933cd6502d24 100644 --- a/mod_wsgi.spec +++ b/mod_wsgi.spec @@ -5,18 +5,16 @@ %{!?_httpd_moddir: %{expand: %%global _httpd_moddir %%{_libdir}/httpd/modules}} %global sphinxbin %{_bindir}/sphinx-build-3 Name: mod_wsgi -Version: 4.6.4 -Release: 3 +Version: 4.9.1 +Release: 1 Summary: A WSGI interface for Python web applications in Apache License: Apache-2.0 URL: https://modwsgi.readthedocs.io/ -Source0: https://github.com/GrahamDumpleton/mod_wsgi/archive/%{version}.tar.gz#/mod_wsgi-%{version}.tar.gz +Source0: https://github.com/GrahamDumpleton/mod_wsgi/archive/refs/tags/%{version}.tar.gz Source1: wsgi-python3.conf Patch1: mod_wsgi-4.5.20-exports.patch -Patch2: Use-official-APIs-for-accessing-interpreter-list.patch -Patch3: Changed-functions-to-pre-post-actions-when-forking.patch -Patch4: CVE-2022-2255.patch -BuildRequires: httpd-devel gcc +Patch2: CVE-2022-2255.patch +BuildRequires: httpd-devel gcc perl chrpath %{?filter_provides_in: %filter_provides_in %{_httpd_moddir}/.*\.so$} %{?filter_setup} %description @@ -67,6 +65,16 @@ install -p -m 644 %{SOURCE1} $RPM_BUILD_ROOT%{_httpd_modconfdir}/10-wsgi-python3 mv $RPM_BUILD_ROOT%{_bindir}/mod_wsgi-express{,-3} popd +chrpath -d %{buildroot}%{python3_sitearch}/mod_wsgi/server/mod_wsgi-py39.cpython-39-%{_arch}-linux-gnu.so +mkdir -p %{buildroot}/etc/ld.so.conf.d +echo "%{_libdir}/python3.9/config" > %{buildroot}/etc/ld.so.conf.d/%{name}-%{_arch}.conf + +%post +/sbin/ldconfig + +%postun +/sbin/ldconfig + %files -n python3-%{name} %license LICENSE %doc CREDITS.rst README.rst @@ -75,8 +83,12 @@ popd %{python3_sitearch}/mod_wsgi-*.egg-info %{python3_sitearch}/mod_wsgi %{_bindir}/mod_wsgi-express-3 +%config(noreplace) /etc/ld.so.conf.d/* %changelog +* Wed Oct 19 2022 wangkai - 4.9.1-1 +- Update to 4.9.1 + * Mon Aug 08 2022 zhuhai95 - 4.6.4-3 - Fix CVE-2022-2255