ALT-PU-2023-8951-1

Package update modsecurity in branch c9f2

Version3.0.10-alt1

Published2023-11-03

Max severityHIGH

Severity:

Closed issues (4)

HIGH7.5

Уязвимость компонента MULTIPART_PART_HEADERS межсетевого экрана для защиты веб-приложений ModSecurity, позволяющая нарушителю обойти защиту брандмауэра

Published: 2024-06-07

CVSS 3.xHIGH 7.5

CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS 2.0HIGH 7.8

CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:N/A:N

References

CVE-2022-48279

HIGH7.5

In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall. NOTE: this is related to CVE-2022-39956 but can be considered independent changes to the ModSecurity (C language) codebase.

Published: 2023-01-20Modified: 2025-07-03

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

HIGH7.5

Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness) because some inputs cause a segfault in the Transaction class for some configurations.

Published: 2023-04-28Modified: 2025-07-03

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

HIGH7.5

Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity.

Published: 2023-07-26Modified: 2025-07-03

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References