You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2019/01/25 14:36:55 UTC
[Bug 63117] New: SetEnv ignores LD_LIBRARY_PATH
https://bz.apache.org/bugzilla/show_bug.cgi?id=63117
Bug ID: 63117
Summary: SetEnv ignores LD_LIBRARY_PATH
Product: Apache httpd-2
Version: 2.4.33
Hardware: All
OS: Solaris
Status: NEW
Severity: normal
Priority: P2
Component: mod_env
Assignee: bugs@httpd.apache.org
Reporter: welter@uni-consult.com
Target Milestone: ---
CGI call to a perl script should pass Env vars set in Directory directive.
The httpd.conf contains
ScriptAlias /cgi-ora/ "/var/apache2/2.4/cgi-ora/"
The perl script needs LD_LIBRARY_PATH set correctly to work properly, so
Directory directive is
<Directory "/var/apache2/2.4/cgi-ora">
AllowOverride None
Options none
SetEnv ORACLE_HOME /oracle/11.2.0
SetEnv LD_LIBRARY_PATH /oracle/11.2.0/lib
SetEnv PERL5LIB
/oracle/11.2.0/perl/lib/site_perl/5.10.0/i86pc-solaris-thread-multi-64
Require all granted
</Directory>
The cgi script itself is just
#!/oracle/11.2.0/perl/bin/perl -I/oracle/11.2.0/perl/lib/5.10.0
print "Content-type: text/html\n\n";
foreach my $i (sort(keys(%ENV))) {
print "$i\t:$ENV{$i}:<br>\n";
}
All "SetEnv" variables are passed correctly *except* LD_LIBRARY_PATH which is
reported as:
/usr/apache2/2.4/lib
The CHANGE log for 2.4.2 refers to SECURITY: CVE-2012-0883 (cve.mitre.org)
referencing LD_LIBRARY_PATH, but it should not lead to ignoring it.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 63117] SetEnv ignores LD_LIBRARY_PATH
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=63117
Eric Covener <co...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution|--- |FIXED
--- Comment #1 from Eric Covener <co...@gmail.com> ---
This (overriding native environment variables that the server already passes
along) was fixed in 2.4.59 and later.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org