Bug 63117 - SetEnv ignores LD_LIBRARY_PATH
Summary: SetEnv ignores LD_LIBRARY_PATH
Status: NEW
Alias: None
Product: Apache httpd-2
Classification: Unclassified
Component: mod_env (show other bugs)
Version: 2.4.33
Hardware: All Solaris
: P2 normal (vote)
Target Milestone: ---
Assignee: Apache HTTPD Bugs Mailing List
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-01-25 14:36 UTC by Alex
Modified: 2019-01-25 14:36 UTC (History)
0 users


Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alex 2019-01-25 14:36:55 UTC 
CGI call to a perl script should pass Env vars set in Directory directive.

The httpd.conf contains
ScriptAlias /cgi-ora/ "/var/apache2/2.4/cgi-ora/"

The perl script needs LD_LIBRARY_PATH set correctly to work properly, so Directory directive is
<Directory "/var/apache2/2.4/cgi-ora">
    AllowOverride None
    Options none
    SetEnv ORACLE_HOME /oracle/11.2.0
    SetEnv LD_LIBRARY_PATH /oracle/11.2.0/lib
    SetEnv PERL5LIB /oracle/11.2.0/perl/lib/site_perl/5.10.0/i86pc-solaris-thread-multi-64
    Require all granted
</Directory>

The cgi script itself is just

#!/oracle/11.2.0/perl/bin/perl -I/oracle/11.2.0/perl/lib/5.10.0
print "Content-type: text/html\n\n";

foreach my $i (sort(keys(%ENV))) {
print "$i\t:$ENV{$i}:<br>\n";
}

All "SetEnv" variables are passed correctly *except* LD_LIBRARY_PATH which is reported as:
/usr/apache2/2.4/lib

The CHANGE log for 2.4.2 refers to SECURITY: CVE-2012-0883 (cve.mitre.org) referencing LD_LIBRARY_PATH, but it should not lead to ignoring it.