Created attachment 249730 [details] patch Hello, This update upgrades ModSecurity to version 2.9.7, which was released over a year ago. It addresses several security-related issues. Trustwave has announced the transfer of ModSecurity custodianship to OWASP, effective January 25, 2024. You can find more information about this change at https://www.modsecurity.org/. As a result of this transfer, the new links have been adjusted accordingly. Additionally, the documentation for the CRS has been updated to reflect some new changes (version 4.0, ...).
Created attachment 253321 [details] Updates mod_security to 2.9.8 Updates to latest version and links against pcre2 instead of deprecated pcre Also reflects project changes since OWASP took over maintainership
*** Bug 279561 has been marked as a duplicate of this bug. ***
I've built with https://bugs.freebsd.org/bugzilla/attachment.cgi?id=253321 in poudriere on 14.1-RELEASE and I'm running with 2.9.8 in our staging env now. If you Pascal agree with my patch, I'd like to move forward with maintainer-timeout and send a request to ports mailing list
(In reply to Einar Bjarni Halldórsson from comment #3) Thanks Einar for updating this issue. Looks good. The only thing I'm currently not sure about is the used source-code. In the current setup, it is using the "packed" modsecurity-v2.9.X.tar.gz from the releases page. Your change is using the "source code" tar.gz from the release page. But I'm not that experienced with the FreeBSD build system and if this is the way to go.
I discovered a bug with 2.9.8 compiled with pcre2. httpd segfaults, apparently when mod_security tries to log: ``` * thread #1, name = 'httpd', stop reason = signal SIGSEGV * frame #0: 0x0000000825107699 libapr-1.so.0`apr_global_mutex_lock + 9 frame #1: 0x000000083a3a2425 mod_security2.so`sec_audit_logger_native(msr=0x00003cdf55b0fa28) at msc_logging.c:1653:14 ``` I'm still debugging it, but I'm told replacing `SecAuditLogType Serial` with `SecAuditLogType Concurrent` doesn't trigger the bug. We're running httpd with syslog logging. I tried reverting my changes to which tarball is fetched, but the bug is also present when using the built tarball.
https://github.com/owasp-modsecurity/ModSecurity/pull/3257 fixes the crashes for me. Hopefully it will get merged soon and a new release put out