CVE-2022-39956: Partial rule set bypass in OWASP ModSecurity Core Rule Set for HTTP multipart requests using character encoding in the Content-Type or Content-Transfer-Encoding header
First published: Mon Sep 19 2022(Updated: )
A flaw was found in the OWASP ModSecurity Core Rule Set. A payload that uses a character encoding scheme via the Content-Type or the deprecated Content-Transfer-Encoding multipart MIME header fields allows HTTP multipart requests to bypass detection.
Credit: vulnerability@ncsc.ch
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/mod_security_crs | <3.2.2 | 3.2.2 |
| redhat/mod_security_crs | <3.3.3 | 3.3.3 |
| Owasp Owasp Modsecurity Core Rule Set | >=3.0.0<3.2.2 | |
| Owasp Owasp Modsecurity Core Rule Set | >=3.3.0<3.3.3 | |
| Fedoraproject Fedora | =35 | |
| Fedoraproject Fedora | =36 | |
| Fedoraproject Fedora | =37 | |
| Debian Debian Linux | =10.0 |
Remedy
upgrade to 3.2.2 or 3.3.3
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2022-39956 https://nvd.nist.gov/vuln/detail/CVE-2022-39956 https://github.com/advisories/GHSA-5xc6-pmr2-qj78
- https://bugzilla.redhat.com/show_bug.cgi?id=2131317
- https://access.redhat.com/security/cve/CVE-2022-39956
- https://coreruleset.org/20220919/crs-version-3-3-3-and-3-2-2-covering-several-cves/
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2131318
- https://lists.debian.org/debian-lts-announce/2023/01/msg00033.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HL2L2GF7GOCWPMJZDUE5OXDSXHGG3XUJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PD56EAYNGB6E6QQH62LAYCONOP6OH5DZ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YPQ6CCMX3MU4A7MTCGQJA7VMJW3IQDXV/
- https://security.gentoo.org/glsa/202305-25
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PD56EAYNGB6E6QQH62LAYCONOP6OH5DZ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YPQ6CCMX3MU4A7MTCGQJA7VMJW3IQDXV/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HL2L2GF7GOCWPMJZDUE5OXDSXHGG3XUJ/
Frequently Asked Questions
What is CVE-2022-39956?
CVE-2022-39956 is a vulnerability in the OWASP ModSecurity Core Rule Set that allows for a partial rule set bypass in HTTP multipart requests.
What is the severity of CVE-2022-39956?
CVE-2022-39956 has a severity rating of 9.8 (Critical).
How does CVE-2022-39956 affect OWASP ModSecurity Core Rule Set?
CVE-2022-39956 affects the OWASP ModSecurity Core Rule Set by allowing a bypass for HTTP multipart requests using certain payload character encoding schemes.
Which versions of OWASP ModSecurity Core Rule Set are affected by CVE-2022-39956?
Versions 3.0.0 to 3.2.2 and versions 3.3.0 to 3.3.3 of the OWASP ModSecurity Core Rule Set are affected by CVE-2022-39956.
How can I fix CVE-2022-39956?
To fix CVE-2022-39956, it is recommended to update to version 3.2.3 or higher for versions 3.0.0 to 3.2.2, and update to version 3.3.4 or higher for versions 3.3.0 to 3.3.3 of the OWASP ModSecurity Core Rule Set.
- collector/redhat-cve
- collector/redhat-bugzilla
- alias/CVE-2022-39956
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- agent/weakness
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/references
- agent/severity
- agent/last-modified-date
- agent/title
- agent/author
- agent/tags
- agent/description
- agent/event
- package-manager/redhat
- vendor/owasp
- canonical/owasp owasp modsecurity core rule set
- version/owasp owasp modsecurity core rule set/3.0.0
- version/owasp owasp modsecurity core rule set/3.3.0
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/35
- version/fedoraproject fedora/36
- version/fedoraproject fedora/37
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/10.0