CVS commit: pkgsrc/security/ap-modsecurity2

["Marcin Gondek" <drixter%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   drixter
Date:           Mon Jul  6 19:05:05 UTC 2026

Modified Files:
        pkgsrc/security/ap-modsecurity2: Makefile PLIST distinfo
Added Files:
        pkgsrc/security/ap-modsecurity2/files: README.pkgsrc
Removed Files:
        pkgsrc/security/ap-modsecurity2: MESSAGE
        pkgsrc/security/ap-modsecurity2/patches: patch-apache2_msc__crypt.c
            patch-apache2_msc__crypt.h

Log Message:
ap-modsecurity2: Update to version 2.9.14

Last version changes:

02 Jul 2026 - 2.9.14
--------------------

 * chore: fix cppcheck issues with v2.21.0
   [Issue #3593 - @airween]
 * fix: ctl:ruleRemoveTargetByTag not removing XML attribute targets
   [Issue #3592 - @fzipi]
 * Remove deprecated REQBODY_PROCESSOR_ERROR and REQBODY_PROCESSOR_ERROR_MSG
   [Issue #3578 - @hnakamur]
 * Re-apply lost fix 4f33f5b: collection_unpack value_len underflow regression
   [Issue #3560 - @g4mm4-VCF]

28 Apr 2026 - 2.9.13
--------------------

 * fix: heap buffer overflow in acmp pm
   [Issue #3545 - @fumfel,@airween]
 * fix: probably UB (left shift of neg. val) in ip_tree code
   [Issue #3542 - @fumfel,@airween]
 * feat(libinjection): add libinjection 4 final to v2
   [Issue #3535 - @airween]
 * fix: cppcheck warnings
   [Issue #3530 - @airween]
 * feat: add Lua 5.5 support when available
   [Issue #3527 - @fzipi,@airween]
 * refactor: remove NGINX support from v2 (#3498)
   [Issue #3502 - @sanjib2006]
 * fix: cppcheck warnings in nginx/
   [Issue #3493 - @umprayz]
 * fix: cppcheck warnings in standalone/
   [Issue #3488 - @umprayz]
 * v2: Accept requests whose body length is exactly equal to SecRequestBodyNoFilesLimit
   [Issue #3480 - @hnakamur]
 * fix: yajl detection for source installations (#3457)
   [Issue #3458 - @weida]
 * feat: fix regression test, add a new CI workflow
   [Issue #3456 - @airween]
 * Fix libxml2 related deprecated issues
   [Issue #3454 - @airween]
 * Add CMake and CI Pipeline for ModSecurityIIS in ModSecurity V2
   [Issue #3452 - @A13501350]
 * fix(iis):  IPv6 Handling in ModSecurity IIS Module
   [Issue #3443 - @A13501350]
 * fix: add event message resources to ModSecurityIIS.dll and resolve "Invalid function" errors (#3408)
   [Issue #3438 - @A13501350]

05 Aug 2025 - 2.9.12
--------------------

 * fix: Improper error handling
   [PR from private repo - @orangetw, @pgajdos, @ylavic, @theseion, @fzipi, @airween
    fixed CVE-2025-54571]
 * fix: mod_security2's regression tests [Issue #3425 - @airween]
 * fix: remove unused condition from msc_status_engine.c [Issue #3412 - @airween]
 * fix: remove unwanted '\0' string terminator from argument's value [Issue #3411 - @airween]

01 Jul 2025 - 2.9.11
--------------------

 * fix: prevent segmentation fault if the XML node is empty
   [PR from private repo - @theseion, @fzipi, @RedXanadu, @airween; fixed CVE-2025-52891]
 * Plug memory leak when msre_op_validateSchema_execute() exits normally (validateSchema)
   [Issue #3401 - @nic-prgs]
 * chore: bump version in MSI installer.wxs
   [Issue #3400 - @airween]
 * Fix resource leaks in `msc_status_engine_mac_address`
   [Issue #3391 - @amezin]

02 Jun 2025 - 2.9.10
--------------------

 * fix: DoS vulnerability
   [PR from private repo - @theseion, @fzipi, @airween; fixed CVE-2025-48866]

21 May 2025 - 2.9.9
-------------------

 * fix: DoS vulnerability
   [PR from private repo - @theseion, @fzipi, @airween; fixed CVE-2025-47947]
 * chore: log error codes for global mutex failure modes.
   [Issue #3387 - @airween]
 * chore: refactor build system to use PCRE2
   [Issue #3383 - @airween]
 * feat: add 'make test' to v2's workflow
   [Issue #3379 - @airween]
 * fix: 'make test' is able to run again
   [Issue #3378 - @airween]
 * fix: add PCRE2 capability to standalone module
   [Issue #3377 - @airween]
 * chore: remove unnecessary @LIBXML2_CFLAGS@ from linker flags
   [Issue #3376 - @airween]
 * fix: add msc_fullinfo() to check JIT compilation
   [Issue #3375 - @airween]
 * Fix error logging for standalone module
   [Issue #3374 - @RedXanadu]
 * Fix compiler warnings from GCC
   [Issue #3372 - @notroj]
 * feat: improved XMLArgs processing
   [Issue #3358 - @airween]
 * Incorrect utf8toUnicode transformation for 00xx
   [Issue #3284 - @marcstern]
 * Fixed PCRE2 error message
   [Issue #3279 - @marcstern]
 * make rootpath and incpath consts for apr_filepath_root
   [Issue #3270 - @Marcool04]
 * Fix apr_global_mutex_create() usage
   [Issue #3269 - @marcstern]
 * chore: add 'log' action to rule 200005 (v2/master)
   [Issue #3267 - @airween]
 * Move id_log() to msc_util to fix unit tests; it is declared on msc_ut…
   [Issue #3265 - @rainerjung]
 * Missing #include <time.h>
   [Issue #3262 - @marcstern]
 * Fixed apr_global_mutex_create() usage (no filename)
   [PR #3269 - @marcstern]
 * handle errors from apr_global_mutex_lock
   [PR #3257 - @marcstern]

03 Sep 2024 - 2.9.8 <-> 31 Mar 2014 - 2.8.0-RC1
-------------------

Please look: https://github.com/owasp-modsecurity/ModSecurity/blob/v2.9.14/CHANGES


To generate a diff of this commit:
cvs rdiff -u -r1.3 -r0 pkgsrc/security/ap-modsecurity2/MESSAGE
cvs rdiff -u -r1.75 -r1.76 pkgsrc/security/ap-modsecurity2/Makefile
cvs rdiff -u -r1.8 -r1.9 pkgsrc/security/ap-modsecurity2/PLIST
cvs rdiff -u -r1.12 -r1.13 pkgsrc/security/ap-modsecurity2/distinfo
cvs rdiff -u -r0 -r1.1 pkgsrc/security/ap-modsecurity2/files/README.pkgsrc
cvs rdiff -u -r1.1 -r0 \
    pkgsrc/security/ap-modsecurity2/patches/patch-apache2_msc__crypt.c \
    pkgsrc/security/ap-modsecurity2/patches/patch-apache2_msc__crypt.h

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/ap-modsecurity2/Makefile
diff -u pkgsrc/security/ap-modsecurity2/Makefile:1.75 pkgsrc/security/ap-modsecurity2/Makefile:1.76
--- pkgsrc/security/ap-modsecurity2/Makefile:1.75       Thu May 14 16:41:59 2026
+++ pkgsrc/security/ap-modsecurity2/Makefile    Mon Jul  6 19:05:05 2026
@@ -1,13 +1,14 @@
-# $NetBSD: Makefile,v 1.75 2026/05/14 16:41:59 ryoon Exp $
+# $NetBSD: Makefile,v 1.76 2026/07/06 19:05:05 drixter Exp $
 
-DISTNAME=      modsecurity-apache_2.7.7
-PKGNAME=       ${APACHE_PKG_PREFIX}-${DISTNAME:S/apache_//}
-PKGREVISION=   44
+DISTNAME=      modsecurity-v2.9.14
+PKGNAME=       ${APACHE_PKG_PREFIX}-${DISTNAME:S/-v/-/}
 CATEGORIES=    www security
-MASTER_SITES=  https://www.modsecurity.org/tarball/${PKGVERSION_NOREV}/
+MASTER_SITES=  ${MASTER_SITE_GITHUB:=owasp-modsecurity/}
+GITHUB_PROJECT=        ModSecurity
+GITHUB_RELEASE=        v${PKGVERSION_NOREV}
 
-MAINTAINER=    pkgsrc-users%NetBSD.org@localhost
-HOMEPAGE=      https://www.modsecurity.org/
+MAINTAINER=    drixter%e-utp.net@localhost
+HOMEPAGE=      https://github.com/owasp-modsecurity/ModSecurity/
 COMMENT=       Intrusion detection and prevention engine for web applications
 LICENSE=       apache-2.0
 
@@ -19,7 +20,7 @@ USE_LANGUAGES=                c++ c
 .include "options.mk"
 
 GNU_CONFIGURE=                 YES
-USE_TOOLS+=                    pax
+USE_TOOLS+=                    pax pkg-config
 USE_LIBTOOL=                   yes
 BUILD_DIRS=                    apache2
 
@@ -41,13 +42,13 @@ CONF_FILES=         ${PREFIX}/${EGDIR}/modsecur
 
 post-install:
        ${RM} -f ${DESTDIR}${PREFIX}/lib/mod_security2.so
-       ${INSTALL_DATA} ${WRKSRC}/modsecurity.conf-recommended \
-                       ${DESTDIR}${PREFIX}/${EGDIR}
-       cd ${WRKSRC}/doc && \
-               pax -rw . ${DESTDIR}${PREFIX}/${DOCDIR}
+       ${INSTALL_DATA} ${WRKSRC}/doc/README.txt  ${DESTDIR}${PREFIX}/${DOCDIR}/
+       ${INSTALL_DATA} ${WRKSRC}/modsecurity.conf-recommended ${DESTDIR}${PREFIX}/${EGDIR}/
+       ${INSTALL_DATA} ${FILESDIR}/README.pkgsrc ${DESTDIR}${PREFIX}/${DOCDIR}/README.pkgsrc
 
 .include "../../textproc/libxml2/buildlink3.mk"
 .include "../../devel/pcre/buildlink3.mk"
 .include "../../devel/readline/buildlink3.mk"
 .include "../../lang/lua51/buildlink3.mk"
+.include "../../devel/yajl/buildlink3.mk"
 .include "../../mk/bsd.pkg.mk"

Index: pkgsrc/security/ap-modsecurity2/PLIST
diff -u pkgsrc/security/ap-modsecurity2/PLIST:1.8 pkgsrc/security/ap-modsecurity2/PLIST:1.9
--- pkgsrc/security/ap-modsecurity2/PLIST:1.8   Thu Feb  6 08:17:42 2014
+++ pkgsrc/security/ap-modsecurity2/PLIST       Mon Jul  6 19:05:05 2026
@@ -1,4 +1,5 @@
-@comment $NetBSD: PLIST,v 1.8 2014/02/06 08:17:42 obache Exp $
+@comment $NetBSD: PLIST,v 1.9 2026/07/06 19:05:05 drixter Exp $
 lib/httpd/mod_security2.so
+share/doc/ap-modsecurity/README.pkgsrc
 share/doc/ap-modsecurity/README.txt
 share/examples/ap-modsecurity/modsecurity.conf-recommended

Index: pkgsrc/security/ap-modsecurity2/distinfo
diff -u pkgsrc/security/ap-modsecurity2/distinfo:1.12 pkgsrc/security/ap-modsecurity2/distinfo:1.13
--- pkgsrc/security/ap-modsecurity2/distinfo:1.12       Tue Oct 26 11:16:59 2021
+++ pkgsrc/security/ap-modsecurity2/distinfo    Mon Jul  6 19:05:05 2026
@@ -1,7 +1,5 @@
-$NetBSD: distinfo,v 1.12 2021/10/26 11:16:59 nia Exp $
+$NetBSD: distinfo,v 1.13 2026/07/06 19:05:05 drixter Exp $
 
-BLAKE2s (modsecurity-apache_2.7.7.tar.gz) = 396cb59d03ccf22faf502cf2d3f6e53b9a18f4b2738025fa68c3e265b02a4747
-SHA512 (modsecurity-apache_2.7.7.tar.gz) = 859f72580b6acaae5db180f98ee32ad2cb0f3ef24321d0c2df20ddd9fcfbc6c09c98b672012dc4931a6fd14f3c21c38ed31ab8900940382fcb48b37f30005a7d
-Size (modsecurity-apache_2.7.7.tar.gz) = 1003835 bytes
-SHA1 (patch-apache2_msc__crypt.c) = 01bdb8291c83a8abbd1e990d96a768d9bec0ef89
-SHA1 (patch-apache2_msc__crypt.h) = dc83f494f81823deddf00dd005a632d085039664
+BLAKE2s (modsecurity-v2.9.14.tar.gz) = e2bb921b92c75e15c23251ca4f08991262d29ebd61eb0e6c527f81ca28af6a2f
+SHA512 (modsecurity-v2.9.14.tar.gz) = 788acc877295daa82d8e1aed7845e904194e54fda66ee5f6c24e57b2d9cf073feff124048942f1551ea1730e3d288818c57f6db27ea2b2c21d841267680535ff
+Size (modsecurity-v2.9.14.tar.gz) = 6644472 bytes

Added files:

Index: pkgsrc/security/ap-modsecurity2/files/README.pkgsrc
diff -u /dev/null pkgsrc/security/ap-modsecurity2/files/README.pkgsrc:1.1
--- /dev/null   Mon Jul  6 19:05:06 2026
+++ pkgsrc/security/ap-modsecurity2/files/README.pkgsrc Mon Jul  6 19:05:05 2026
@@ -0,0 +1,26 @@
+===========================================================================
+$NetBSD: README.pkgsrc,v 1.1 2026/07/06 19:05:05 drixter Exp $
+
+In order to use this module in your Apache installation, you will need
+to add the following to your httpd.conf file:
+
+  LoadModule security2_module lib/httpd/mod_security2.so
+
+In addition to this you will need to specify mod_security configuration
+directives in your httpd.conf.  This can be achieved by adding the
+following to your httpd.conf:
+
+  <IfModule mod_security2.c>
+      Include ${PKG_SYSCONFDIR}/httpd/modsecurity.conf
+  </IfModule>
+
+Example configuration files for modsecurity are available:
+
+  ${PREFIX}/share/examples/ap-modsecurity/
+
+In order to use the XML support in your Apache installation, you will need
+to add the following to your httpd.conf file:
+
+  LoadFile ${PREFIX}/lib/libxml2.so
+
+===========================================================================