Modsecurity errors because different PCRE versions

Discussion in 'Server Operation' started by MaxT, Dec 15, 2022.

Tags:
  1. MaxT

    MaxT Member HowtoForge Supporter

    Hi,
    I have this Modsecurity complaint about different PCRE versions:
    Code:
    [Thu Dec 15 10:40:05.166909 2022] [:notice] [pid 15136] ModSecurity: PCRE compiled version="8.39 "; loaded version="8.44 2020-02-12"
[Thu Dec 15 10:40:05.166911 2022] [:warn] [pid 15136] ModSecurity: Loaded PCRE do not match with compiled!
    It causes some errors in the modsec blocking action. I have tried to uninstall Modsecurity and reinstall again ("apt install libapache2-mod-security2"), although the error continues.

    And I believe I cannot uninstall PCRE without affecting Apache and ISPC install... Is this right?

    Do you know some way to solve this PCRE inconsistency?.
     
    MaxT, Dec 15, 2022
    #1
  2. michelangelo

    michelangelo Active Member

    The source from which you obtained your modsecurity was using a different PCRE version at the time of build.
    Either report to your upstream source that this issue needs to be fixed or build modsecurity yourself.
     
    michelangelo, Dec 16, 2022
    #2
    MaxT likes this.
  3. MaxT

    MaxT Member HowtoForge Supporter

    the source was the official Debian repos.... I will try to compile modsecurity from sources. Thanks for the clarification

    So it sounds like a terrible failure when there are thousand servers using Debian, and modsecurity is quite common. Amazing
     
    MaxT, Dec 16, 2022
    #3
  4. MaxT

    MaxT Member HowtoForge Supporter

    I have solved the problem although the issue was more complicated. Compilation of Modsecurity didn't help.

    First I have removed libpcre:
    Code:
    # apt remove libpcre3 libpcre3-dev
    although it forces to partially uninstall php 7.0 additional version. Then I uninstall php 7.0 completely:

    Code:
    # apt-get remove php7.0 php7.0-cli php7.0-cgi php7.0-fpm php7.0-gd php7.0-mysql php7.0-imap php7.0-curl php7
.0-intl php7.0-pspell php7.0-recode php7.0-sqlite3 php7.0-tidy php7.0-xmlrpc php7.0-xsl php7.0-zip php7.0-mbstring php7.0-soap php7.0-opcache php7.0-common php7.0-json php7.0-readline php7.0-xml

#apt autoremove
    after that, I have downloaded the expected PCRE version: libpcre3_8.39-12_amd64.deb to install manually:
    Code:
    # wget http://ftp.de.debian.org/debian/pool/main/p/pcre3/libpcre3_8.39-12_amd64.deb
# apt install ./libpcre3_8.39-12_amd64.deb
    and now the PCRE version is right:
    Code:
    # service apache2 restart
# grep PCRE /var/log/apache2/error.log
[Fri Dec 16 19:44:10.494651 2022] [:notice] [pid 28291] ModSecurity: PCRE compiled version="8.39 "; loaded version="8.39 2016-06-14"
    finally, I have retained the llibpcre package to avoid updates. Although one adverse effect is when now, the install of php7.0 is not possible because dependence errors:

    php7.0-cgi : Depends: libpcre3 (>= 2:8.41)
    php7.0-cli : Depends: libpcre3 (>= 2:8.41)
    php7.0-fpm : Depends: libpcre3 (>= 2:8.41)

    so I wonder if maybe the different PCRE versions were caused because the additional php 7.0 version from the Sury repos. I'm not sure

    It seems I should choose between keeping Modsecurity or php 7.0. Not very problematic when there are no special differences with default php 7.3, although no a perfect solution.

    If somebody knows a better solution, it would be good to know.

    I leave here in case this can be of some help
     
    MaxT, Dec 16, 2022
    #4

Share This Page