CVS commit: [pkgsrc-2026Q2] pkgsrc/security/ap-modsecurity2

["Maya Rashish" <maya%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   maya
Date:           Fri Jul 17 02:03:18 UTC 2026

Modified Files:
        pkgsrc/security/ap-modsecurity2 [pkgsrc-2026Q2]: Makefile PLIST
            distinfo
Added Files:
        pkgsrc/security/ap-modsecurity2/files [pkgsrc-2026Q2]: README.pkgsrc
Removed Files:
        pkgsrc/security/ap-modsecurity2 [pkgsrc-2026Q2]: MESSAGE
        pkgsrc/security/ap-modsecurity2/patches [pkgsrc-2026Q2]:
            patch-apache2_msc__crypt.c patch-apache2_msc__crypt.h

Log Message:
Pullup ticket #7186 - requested by taca
security/ap-modsecurity2: Security fix

Revisions pulled up:
- security/ap-modsecurity2/MESSAGE                              deleted
- security/ap-modsecurity2/Makefile                             1.76
- security/ap-modsecurity2/PLIST                                1.9
- security/ap-modsecurity2/distinfo                             1.13
- security/ap-modsecurity2/files/README.pkgsrc                  1.1
- security/ap-modsecurity2/patches/patch-apache2_msc__crypt.c   deleted
- security/ap-modsecurity2/patches/patch-apache2_msc__crypt.h   deleted

---
   Module Name: pkgsrc
   Committed By:        drixter
   Date:                Mon Jul  6 19:05:05 UTC 2026

   Modified Files:
        pkgsrc/security/ap-modsecurity2: Makefile PLIST distinfo
   Added Files:
        pkgsrc/security/ap-modsecurity2/files: README.pkgsrc
   Removed Files:
        pkgsrc/security/ap-modsecurity2: MESSAGE
        pkgsrc/security/ap-modsecurity2/patches: patch-apache2_msc__crypt.c
            patch-apache2_msc__crypt.h

   Log Message:
   ap-modsecurity2: Update to version 2.9.14

   Last version changes:

   02 Jul 2026 - 2.9.14
   --------------------

    * chore: fix cppcheck issues with v2.21.0
      [Issue #3593 - @airween]
    * fix: ctl:ruleRemoveTargetByTag not removing XML attribute targets
      [Issue #3592 - @fzipi]
    * Remove deprecated REQBODY_PROCESSOR_ERROR and REQBODY_PROCESSOR_ERROR_MSG
      [Issue #3578 - @hnakamur]
    * Re-apply lost fix 4f33f5b: collection_unpack value_len underflow regression
      [Issue #3560 - @g4mm4-VCF]

   28 Apr 2026 - 2.9.13
   --------------------

    * fix: heap buffer overflow in acmp pm
      [Issue #3545 - @fumfel,@airween]
    * fix: probably UB (left shift of neg. val) in ip_tree code
      [Issue #3542 - @fumfel,@airween]
    * feat(libinjection): add libinjection 4 final to v2
      [Issue #3535 - @airween]
    * fix: cppcheck warnings
      [Issue #3530 - @airween]
    * feat: add Lua 5.5 support when available
      [Issue #3527 - @fzipi,@airween]
    * refactor: remove NGINX support from v2 (#3498)
      [Issue #3502 - @sanjib2006]
    * fix: cppcheck warnings in nginx/
      [Issue #3493 - @umprayz]
    * fix: cppcheck warnings in standalone/
      [Issue #3488 - @umprayz]
    * v2: Accept requests whose body length is exactly equal to SecRequestBodyNoFilesLimit
      [Issue #3480 - @hnakamur]
    * fix: yajl detection for source installations (#3457)
      [Issue #3458 - @weida]
    * feat: fix regression test, add a new CI workflow
      [Issue #3456 - @airween]
    * Fix libxml2 related deprecated issues
      [Issue #3454 - @airween]
    * Add CMake and CI Pipeline for ModSecurityIIS in ModSecurity V2
      [Issue #3452 - @A13501350]
    * fix(iis):  IPv6 Handling in ModSecurity IIS Module
      [Issue #3443 - @A13501350]
    * fix: add event message resources to ModSecurityIIS.dll and resolve "Invalid function" errors (#3408)
      [Issue #3438 - @A13501350]

   05 Aug 2025 - 2.9.12
   --------------------

    * fix: Improper error handling
      [PR from private repo - @orangetw, @pgajdos, @ylavic, @theseion, @fzipi, @airween
       fixed CVE-2025-54571]
    * fix: mod_security2's regression tests [Issue #3425 - @airween]
    * fix: remove unused condition from msc_status_engine.c [Issue #3412 - @airween]
    * fix: remove unwanted '\0' string terminator from argument's value [Issue #3411 - @airween]

   01 Jul 2025 - 2.9.11
   --------------------

    * fix: prevent segmentation fault if the XML node is empty
      [PR from private repo - @theseion, @fzipi, @RedXanadu, @airween; fixed CVE-2025-52891]
    * Plug memory leak when msre_op_validateSchema_execute() exits normally (validateSchema)
      [Issue #3401 - @nic-prgs]
    * chore: bump version in MSI installer.wxs
      [Issue #3400 - @airween]
    * Fix resource leaks in `msc_status_engine_mac_address`
      [Issue #3391 - @amezin]

   02 Jun 2025 - 2.9.10
   --------------------

    * fix: DoS vulnerability
      [PR from private repo - @theseion, @fzipi, @airween; fixed CVE-2025-48866]

   21 May 2025 - 2.9.9
   -------------------

    * fix: DoS vulnerability
      [PR from private repo - @theseion, @fzipi, @airween; fixed CVE-2025-47947]
    * chore: log error codes for global mutex failure modes.
      [Issue #3387 - @airween]
    * chore: refactor build system to use PCRE2
      [Issue #3383 - @airween]
    * feat: add 'make test' to v2's workflow
      [Issue #3379 - @airween]
    * fix: 'make test' is able to run again
      [Issue #3378 - @airween]
    * fix: add PCRE2 capability to standalone module
      [Issue #3377 - @airween]
    * chore: remove unnecessary @LIBXML2_CFLAGS@ from linker flags
      [Issue #3376 - @airween]
    * fix: add msc_fullinfo() to check JIT compilation
      [Issue #3375 - @airween]
    * Fix error logging for standalone module
      [Issue #3374 - @RedXanadu]
    * Fix compiler warnings from GCC
      [Issue #3372 - @notroj]
    * feat: improved XMLArgs processing
      [Issue #3358 - @airween]
    * Incorrect utf8toUnicode transformation for 00xx
      [Issue #3284 - @marcstern]
    * Fixed PCRE2 error message
      [Issue #3279 - @marcstern]
    * make rootpath and incpath consts for apr_filepath_root
      [Issue #3270 - @Marcool04]
    * Fix apr_global_mutex_create() usage
      [Issue #3269 - @marcstern]
    * chore: add 'log' action to rule 200005 (v2/master)
      [Issue #3267 - @airween]
    * Move id_log() to msc_util to fix unit tests; it is declared on msc_ut␛$B!D␛(B
      [Issue #3265 - @rainerjung]
    * Missing #include <time.h>
      [Issue #3262 - @marcstern]
    * Fixed apr_global_mutex_create() usage (no filename)
      [PR #3269 - @marcstern]
    * handle errors from apr_global_mutex_lock
      [PR #3257 - @marcstern]

   03 Sep 2024 - 2.9.8 <-> 31 Mar 2014 - 2.8.0-RC1
   -------------------

   Please look: https://github.com/owasp-modsecurity/ModSecurity/blob/v2.9.14/CHANGES


To generate a diff of this commit:
cvs rdiff -u -r1.3 -r0 pkgsrc/security/ap-modsecurity2/MESSAGE
cvs rdiff -u -r1.75 -r1.75.2.1 pkgsrc/security/ap-modsecurity2/Makefile
cvs rdiff -u -r1.8 -r1.8.100.1 pkgsrc/security/ap-modsecurity2/PLIST
cvs rdiff -u -r1.12 -r1.12.38.1 pkgsrc/security/ap-modsecurity2/distinfo
cvs rdiff -u -r0 -r1.1.2.2 \
    pkgsrc/security/ap-modsecurity2/files/README.pkgsrc
cvs rdiff -u -r1.1 -r0 \
    pkgsrc/security/ap-modsecurity2/patches/patch-apache2_msc__crypt.c \
    pkgsrc/security/ap-modsecurity2/patches/patch-apache2_msc__crypt.h

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/ap-modsecurity2/Makefile
diff -u pkgsrc/security/ap-modsecurity2/Makefile:1.75 pkgsrc/security/ap-modsecurity2/Makefile:1.75.2.1
--- pkgsrc/security/ap-modsecurity2/Makefile:1.75       Thu May 14 16:41:59 2026
+++ pkgsrc/security/ap-modsecurity2/Makefile    Fri Jul 17 02:03:17 2026
@@ -1,13 +1,14 @@
-# $NetBSD: Makefile,v 1.75 2026/05/14 16:41:59 ryoon Exp $
+# $NetBSD: Makefile,v 1.75.2.1 2026/07/17 02:03:17 maya Exp $
 
-DISTNAME=      modsecurity-apache_2.7.7
-PKGNAME=       ${APACHE_PKG_PREFIX}-${DISTNAME:S/apache_//}
-PKGREVISION=   44
+DISTNAME=      modsecurity-v2.9.14
+PKGNAME=       ${APACHE_PKG_PREFIX}-${DISTNAME:S/-v/-/}
 CATEGORIES=    www security
-MASTER_SITES=  https://www.modsecurity.org/tarball/${PKGVERSION_NOREV}/
+MASTER_SITES=  ${MASTER_SITE_GITHUB:=owasp-modsecurity/}
+GITHUB_PROJECT=        ModSecurity
+GITHUB_RELEASE=        v${PKGVERSION_NOREV}
 
-MAINTAINER=    pkgsrc-users%NetBSD.org@localhost
-HOMEPAGE=      https://www.modsecurity.org/
+MAINTAINER=    drixter%e-utp.net@localhost
+HOMEPAGE=      https://github.com/owasp-modsecurity/ModSecurity/
 COMMENT=       Intrusion detection and prevention engine for web applications
 LICENSE=       apache-2.0
 
@@ -19,7 +20,7 @@ USE_LANGUAGES=                c++ c
 .include "options.mk"
 
 GNU_CONFIGURE=                 YES
-USE_TOOLS+=                    pax
+USE_TOOLS+=                    pax pkg-config
 USE_LIBTOOL=                   yes
 BUILD_DIRS=                    apache2
 
@@ -41,13 +42,13 @@ CONF_FILES=         ${PREFIX}/${EGDIR}/modsecur
 
 post-install:
        ${RM} -f ${DESTDIR}${PREFIX}/lib/mod_security2.so
-       ${INSTALL_DATA} ${WRKSRC}/modsecurity.conf-recommended \
-                       ${DESTDIR}${PREFIX}/${EGDIR}
-       cd ${WRKSRC}/doc && \
-               pax -rw . ${DESTDIR}${PREFIX}/${DOCDIR}
+       ${INSTALL_DATA} ${WRKSRC}/doc/README.txt  ${DESTDIR}${PREFIX}/${DOCDIR}/
+       ${INSTALL_DATA} ${WRKSRC}/modsecurity.conf-recommended ${DESTDIR}${PREFIX}/${EGDIR}/
+       ${INSTALL_DATA} ${FILESDIR}/README.pkgsrc ${DESTDIR}${PREFIX}/${DOCDIR}/README.pkgsrc
 
 .include "../../textproc/libxml2/buildlink3.mk"
 .include "../../devel/pcre/buildlink3.mk"
 .include "../../devel/readline/buildlink3.mk"
 .include "../../lang/lua51/buildlink3.mk"
+.include "../../devel/yajl/buildlink3.mk"
 .include "../../mk/bsd.pkg.mk"

Index: pkgsrc/security/ap-modsecurity2/PLIST
diff -u pkgsrc/security/ap-modsecurity2/PLIST:1.8 pkgsrc/security/ap-modsecurity2/PLIST:1.8.100.1
--- pkgsrc/security/ap-modsecurity2/PLIST:1.8   Thu Feb  6 08:17:42 2014
+++ pkgsrc/security/ap-modsecurity2/PLIST       Fri Jul 17 02:03:17 2026
@@ -1,4 +1,5 @@
-@comment $NetBSD: PLIST,v 1.8 2014/02/06 08:17:42 obache Exp $
+@comment $NetBSD: PLIST,v 1.8.100.1 2026/07/17 02:03:17 maya Exp $
 lib/httpd/mod_security2.so
+share/doc/ap-modsecurity/README.pkgsrc
 share/doc/ap-modsecurity/README.txt
 share/examples/ap-modsecurity/modsecurity.conf-recommended

Index: pkgsrc/security/ap-modsecurity2/distinfo
diff -u pkgsrc/security/ap-modsecurity2/distinfo:1.12 pkgsrc/security/ap-modsecurity2/distinfo:1.12.38.1
--- pkgsrc/security/ap-modsecurity2/distinfo:1.12       Tue Oct 26 11:16:59 2021
+++ pkgsrc/security/ap-modsecurity2/distinfo    Fri Jul 17 02:03:17 2026
@@ -1,7 +1,5 @@
-$NetBSD: distinfo,v 1.12 2021/10/26 11:16:59 nia Exp $
+$NetBSD: distinfo,v 1.12.38.1 2026/07/17 02:03:17 maya Exp $
 
-BLAKE2s (modsecurity-apache_2.7.7.tar.gz) = 396cb59d03ccf22faf502cf2d3f6e53b9a18f4b2738025fa68c3e265b02a4747
-SHA512 (modsecurity-apache_2.7.7.tar.gz) = 859f72580b6acaae5db180f98ee32ad2cb0f3ef24321d0c2df20ddd9fcfbc6c09c98b672012dc4931a6fd14f3c21c38ed31ab8900940382fcb48b37f30005a7d
-Size (modsecurity-apache_2.7.7.tar.gz) = 1003835 bytes
-SHA1 (patch-apache2_msc__crypt.c) = 01bdb8291c83a8abbd1e990d96a768d9bec0ef89
-SHA1 (patch-apache2_msc__crypt.h) = dc83f494f81823deddf00dd005a632d085039664
+BLAKE2s (modsecurity-v2.9.14.tar.gz) = e2bb921b92c75e15c23251ca4f08991262d29ebd61eb0e6c527f81ca28af6a2f
+SHA512 (modsecurity-v2.9.14.tar.gz) = 788acc877295daa82d8e1aed7845e904194e54fda66ee5f6c24e57b2d9cf073feff124048942f1551ea1730e3d288818c57f6db27ea2b2c21d841267680535ff
+Size (modsecurity-v2.9.14.tar.gz) = 6644472 bytes

Added files:

Index: pkgsrc/security/ap-modsecurity2/files/README.pkgsrc
diff -u /dev/null pkgsrc/security/ap-modsecurity2/files/README.pkgsrc:1.1.2.2
--- /dev/null   Fri Jul 17 02:03:18 2026
+++ pkgsrc/security/ap-modsecurity2/files/README.pkgsrc Fri Jul 17 02:03:18 2026
@@ -0,0 +1,26 @@
+===========================================================================
+$NetBSD: README.pkgsrc,v 1.1.2.2 2026/07/17 02:03:18 maya Exp $
+
+In order to use this module in your Apache installation, you will need
+to add the following to your httpd.conf file:
+
+  LoadModule security2_module lib/httpd/mod_security2.so
+
+In addition to this you will need to specify mod_security configuration
+directives in your httpd.conf.  This can be achieved by adding the
+following to your httpd.conf:
+
+  <IfModule mod_security2.c>
+      Include ${PKG_SYSCONFDIR}/httpd/modsecurity.conf
+  </IfModule>
+
+Example configuration files for modsecurity are available:
+
+  ${PREFIX}/share/examples/ap-modsecurity/
+
+In order to use the XML support in your Apache installation, you will need
+to add the following to your httpd.conf file:
+
+  LoadFile ${PREFIX}/lib/libxml2.so
+
+===========================================================================