Bug#752872: libapr1: file locking is broken, leading to file corruption in e.g. libapache2-mod-auth-cas session files

[Stefan Fritsch <sf@sfritsch.de>]

severity 752872 important
found 752872 1.4.6-3
thanks

On Friday 27 June 2014 11:37:18, Joost van Baal-Ilić wrote:
> While libapr1 defaults to fcntl() locking it also supports flock(),
> which does not have the problems outlined above. A patch is
> attached which makes libapr1 use flock() even if fcntl() locking is
> available.

flock does not support locking on NFS (at least according to its man 
page), while fcntl does. I am undecided which is worse.

Since there does not seem to be a good solution, I am downgrading the 
severity of this bug.