REDHAT-BUG-2367903: High severity ModSecurity modsecurity vulnerability
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case (in stable released versions): when the payload's content type is application/json, and there is at least one rule which does a sanitiseMatchedBytes action. A patch is available at pull request 3389 and expected to be part of version 2.9.9. No known workarounds are available.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2367903?
REDHAT-BUG-2367903 has been classified as a denial of service vulnerability, which can significantly disrupt service availability.
How do I fix REDHAT-BUG-2367903?
To fix REDHAT-BUG-2367903, upgrade ModSecurity to version 2.9.9 or later, which addresses the denial of service issue.
What software is affected by REDHAT-BUG-2367903?
REDHAT-BUG-2367903 affects ModSecurity versions up to and including 2.9.8.
What is the impact of REDHAT-BUG-2367903?
The impact of REDHAT-BUG-2367903 is the potential for a denial of service, which could make web applications temporarily unavailable.
When was REDHAT-BUG-2367903 discovered?
The specific discovery date for REDHAT-BUG-2367903 is not provided, but it is indicated in the context of stable released versions.