Bug 63117

Summary: SetEnv ignores LD_LIBRARY_PATH
Product: Apache httpd-2 Reporter: Alex <welter>
Component: mod_envAssignee: Apache HTTPD Bugs Mailing List <bugs>
Status: NEW ---    
Severity: normal    
Priority: P2    
Version: 2.4.33   
Target Milestone: ---   
Hardware: All   
OS: Solaris   

Description Alex 2019-01-25 14:36:55 UTC
CGI call to a perl script should pass Env vars set in Directory directive.

The httpd.conf contains
ScriptAlias /cgi-ora/ "/var/apache2/2.4/cgi-ora/"

The perl script needs LD_LIBRARY_PATH set correctly to work properly, so Directory directive is
<Directory "/var/apache2/2.4/cgi-ora">
    AllowOverride None
    Options none
    SetEnv ORACLE_HOME /oracle/11.2.0
    SetEnv LD_LIBRARY_PATH /oracle/11.2.0/lib
    SetEnv PERL5LIB /oracle/11.2.0/perl/lib/site_perl/5.10.0/i86pc-solaris-thread-multi-64
    Require all granted
</Directory>

The cgi script itself is just

#!/oracle/11.2.0/perl/bin/perl -I/oracle/11.2.0/perl/lib/5.10.0
print "Content-type: text/html\n\n";

foreach my $i (sort(keys(%ENV))) {
print "$i\t:$ENV{$i}:<br>\n";
}

All "SetEnv" variables are passed correctly *except* LD_LIBRARY_PATH which is reported as:
/usr/apache2/2.4/lib

The CHANGE log for 2.4.2 refers to SECURITY: CVE-2012-0883 (cve.mitre.org) referencing LD_LIBRARY_PATH, but it should not lead to ignoring it.