Bug#975048: apache2-bin: AuthLDAPBindPassword exec: directive creates zombie processes

[Moritz Schlarb <schlarbm@uni-mainz.de>]

Package: apache2-bin
Version: 2.4.46-1~bpo10
Severity: important
Tags: patch upstream
Forwarded: https://bz.apache.org/bugzilla/show_bug.cgi?id=61817
X-Debbugs-Cc: martin@uni-mainz.de

We are experiencing the following bug that has previously been reported to
upstream:
Bug 61817 - AuthLDAPBindPassword exec: directive (ap_get_exec_line()) creates
defunct/zombie
https://bz.apache.org/bugzilla/show_bug.cgi?id=61817

This is what ps looks like after 6 hours:
ps auxfw | grep -C3 apache
USER        PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root       7239  0.0  0.0   9780  4944 ?        Rs   12:11   0:00 ps auxfw
root          1  0.0  6.5 1861092 534936 ?      Ss   05:31   0:03
/usr/sbin/apache2 -DFOREGROUND -k start
infosys     440  1.6  0.9 4446004 76156 ?       Sl   05:31   6:44
/usr/sbin/apache2 -DFOREGROUND -k start
infosys     574  0.0  0.0      0     0 ?        Z    05:31   0:00  \_ [cat]
<defunct>
infosys     575  0.0  0.0      0     0 ?        Z    05:31   0:00  \_ [cat]
<defunct>
infosys     642  0.0  0.0      0     0 ?        Z    05:32   0:00  \_ [cat]
<defunct>
--
infosys    7147  0.0  0.0      0     0 ?        Z    12:06   0:00  \_ [cat]
<defunct>
infosys    7157  0.0  0.0      0     0 ?        Z    12:08   0:00  \_ [cat]
<defunct>
infosys    7158  0.0  0.0      0     0 ?        Z    12:08   0:00  \_ [cat]
<defunct>
infosys     442  1.2  0.8 4437720 71588 ?       Sl   05:31   4:51
/usr/sbin/apache2 -DFOREGROUND -k start
infosys     572  0.0  0.0      0     0 ?        Z    05:31   0:00  \_ [cat]
<defunct>
infosys     573  0.0  0.0      0     0 ?        Z    05:31   0:00  \_ [cat]
<defunct>
infosys     640  0.0  0.0      0     0 ?        Z    05:32   0:00  \_ [cat]
<defunct>

And we are indeed using the
AuthLDAPBindPassword "exec:/bin/cat <...>"
directive in our Apache configuration.

Please consider including a/the patch in the current stable and the buster-
backports version of the package.



-- Package-specific info:

-- System Information:
Debian Release: bullseye/sid
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 5.9.0-1-amd64 (SMP w/8 CPU threads)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages apache2-bin is related to:
pn  apache2      <none>
ii  apache2-bin  2.4.46-1