OpenSuSE has issued an advisory on July 30: http://lists.opensuse.org/opensuse-updates/2014-07/msg00033.html Mageia 3 and Mageia 4 are also affected. Reproducible: Steps to Reproduce:
Whiteboard: (none) => MGA4TOO, MGA3TOO
http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.2.6.html 1. Apache 2.2.3 and older doesnât provide the ap_get_server_description() function. Using mod_wsgi with such older versions would therefore cause processes to crash when Apache was being started up. For older versions of Apache now fallback to using ap_get_server_version() instead. Seems like a non issue to me.
CC: (none) => oe
Oops! Need more coffey.
Fixed with apache-mod_wsgi-3.5-1.mga3, apache-mod_wsgi-3.5-1.1.mga4 and apache-mod_wsgi-4.2.6-1.mga5.
Thanks Oden! Advisory: ======================== Updated apache-mod_wsgi package fixes security vulnerability: apache-mod_wsgi before 4.2.4 contained an off-by-one error in applying a limit to the number of supplementary groups allowed for a daemon process group. The result could be that if more groups than the operating system allowed were specified to the option supplementary-groups, then memory corruption or a process crash could occur. References: http://lists.opensuse.org/opensuse-updates/2014-07/msg00033.html ======================== Updated packages in core/updates_testing: ======================== apache-mod_wsgi-3.5-1.mga3 apache-mod_wsgi-3.5-1.1.mga4 from SRPMS: apache-mod_wsgi-3.5-1.mga3.src.rpm apache-mod_wsgi-3.5-1.1.mga4.src.rpm
CC: (none) => shlomifVersion: Cauldron => 4Assignee: shlomif => qa-bugsWhiteboard: MGA4TOO, MGA3TOO => MGA3TOO
Some info about this here: http://code.google.com/p/modwsgi/wiki/QuickConfigurationGuide
Testing complete mga4 64 Using the example code from the link in comment 5 saved as /var/www/wsgi-scripts/helloworld.wsgi def application(environ, start_response): status = '200 OK' output = 'Hello World!' response_headers = [('Content-type', 'text/plain'), ('Content-Length', str(len(output)))] start_response(status, response_headers) return [output] Edited /etc/httpd/conf/conf.d/wsgi.conf and added the WSGIScriptAlias line below the IfModule, as below.. <IfModule mod_wsgi.c> WSGIScriptAlias /wsgi /var/www/wsgi-scripts/helloworld.wsgi Browsed to http://localhost/wsgi to see the "Hello World!" text displayed
Whiteboard: MGA3TOO => MGA3TOO has_procedure mga4-64-ok
Another working example.. import cgi def application(environ, start_response): form = cgi.FieldStorage(fp=environ['wsgi.input'], environ=environ, keep_blank_values=1) write = start_response('200 OK', [('Content-type', 'text/html')]) if form.getvalue('name'): write('<html><head><title>Hello!</title></head>\n') write('<body>\n') write('<h1>Hello %s!</h1>\n' % form['name'].value) else: write('<html><head><title>Who is there?</title></head>\n') write('<body>\n') write('<h1>Who is there?</h1>\n') write('<form action="%s" method="POST">\n' % environ['SCRIPT_NAME']) write('What is your name?<br>\n') write('<input type="text" name="name" value="%s"><br>\n' % cgi.escape(form.getvalue('name', ''), 1)) write('<input type="submit" value="That is my name"></form>\n') write('</body></html>\n') return None
Testing complete on Mageia 3 32bit, using the procedure in comment 6 and 7. Small addendum to the procedure, one has to restart Apache (systemctl restart httpd) after having edited /etc/httpd/conf/conf.d/wsgi.conf.
CC: (none) => remiWhiteboard: MGA3TOO has_procedure mga4-64-ok => MGA3TOO has_procedure mga3-32-ok mga4-64-ok
As discussed during today's QA meeting [1], most updates can now be validated once they have been tested on each release and at least one arch (preferably different arches on each release). Validating the update, advisory uploaded. [1] http://meetbot.mageia.org/mageia-qa/2014/mageia-qa.2014-08-07-19.06.html
Keywords: (none) => validated_updateWhiteboard: MGA3TOO has_procedure mga3-32-ok mga4-64-ok => MGA3TOO has_procedure mga3-32-ok mga4-64-ok advisoryCC: (none) => sysadmin-bugs
An update for this issue has been pushed to Mageia Updates repository. http://advisories.mageia.org/MGASA-2014-0323.html
Status: NEW => RESOLVEDResolution: (none) => FIXED