CVE-2020-15598

** DISPUTED ** Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. NOTE: The discoverer reports "Trustwave has signaled they are disputing our claims." The CVE suggests that there is a security issue with how ModSecurity handles regular expressions that can result in a Denial of Service condition. The vendor does not consider this as a security issue because1) there is no default configuration issue here. An attacker would need to know that a rule using a potentially problematic regular expression was in place, 2) the attacker would need to know the basic nature of the regular expression itself to exploit any resource issues. It's well known that regular expression usage can be taxing on system resources regardless of the use case. It is up to the administrator to decide on when it is appropriate to trade resources for potential security benefit.

Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. NOTE: The discoverer reports "Trustwave has signaled they are disputing our claims." The CVE suggests that there is a security issue with how ModSecurity handles regular expressions that can result in a Denial of Service condition. The vendor does not consider this as a security issue because1) there is no default configuration issue here. An attacker would need to know that a rule using a potentially problematic regular expression was in place, 2) the attacker would need to know the basic nature of the regular expression itself to exploit any resource issues. It's well known that regular expression usage can be taxing on system resources regardless of the use case. It is up to the administrator to decide on when it is appropriate to trade resources for potential security benefit

Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. NOTE: The discoverer reports "Trustwave has signaled they are disputing our claims." The CVE suggests that there is a security issue with how ModSecurity handles regular expressions that can result in a Denial of Service condition. The vendor does not consider this as a security issue because1) there is no default configuration issue here. An attacker would need to know that a rule using a potentially problematic regular expression was in place, 2) the attacker would need to know the basic nature of the regular expression itself to exploit any resource issues. It's well known that regular expression usage can be taxing on system resources regardless of the use case. It is up to the administrator to decide on when it is appropriate to trade resources for potential security benefit

This update for modsecurity fixes the following issues:

Update to version 3.0.10:

• Security impacting issue (fix boo#1213702, CVE-2023-38285)

  • Fix: worst-case time in implementation of four transformations
  • Additional information on this issue is available at https://www.trustwave.com/resources/blogs/spiderlabs-blog/modsecurity-v3-dos-vulnerability-in-four-transformations-cve-2023-38285/

• Enhancements and bug fixes

  • Add TX synonym for MSC_PCRE_LIMITS_EXCEEDED
  • Make MULTIPART_PART_HEADERS accessible to lua
  • Fix: Lua scripts cannot read whole collection at once
  • Fix: quoted Include config with wildcard
  • Support isolated PCRE match limits
  • Fix: meta actions not applied if multiMatch in first rule of chain
  • Fix: audit log may omit tags when multiMatch
  • Exclude CRLF from MULTIPART_PART_HEADER value
  • Configure: use AS_ECHO_N instead echo -n
  • Adjust position of memset from 2890

Update to version 3.0.9:

• Add some member variable inits in Transaction class (possible segfault)
• Fix: possible segfault on reload if duplicate ip+CIDR in ip match list
• Resolve memory leak on reload (bison-generated variable)
• Support equals sign in XPath expressions
• Encode two special chars in error.log output
• Add JIT support for PCRE2
• Support comments in ipMatchFromFile file via '#' token
• Use name package name libmaxminddb with pkg-config
• Fix: FILES_TMP_CONTENT collection key should use part name
• Use AS_HELP_STRING instead of obsolete AC_HELP_STRING macro
• During configure, do not check for pcre if pcre2 specified
• Use pkg-config to find libxml2 first
• Fix two rule-reload memory leak issues
• Correct whitespace handling for Include directive

• Fix CVE-2023-28882, a segfault and a resultant crash of a worker process in some configurations with certain inputs, boo#1210993

Update to version 3.0.8

• Adjust parser activation rules in modsecurity.conf-recommended [#2796]
• Multipart parsing fixes and new MULTIPART_PART_HEADERS collection [#2795]
• Prevent LMDB related segfault [#2755, #2761]
• Fix msc_transaction_cleanup function comment typo [#2788]
• Fix: MULTIPART_INVALID_PART connected to wrong internal variable [#2785]
• Restore Unique_id to include random portion after timestamp [#2752, #2758]

Update to version 3.0.7

• Support PCRE2
• Support SecRequestBodyNoFilesLimit
• Add ctl:auditEngine action support
• Move PCRE2 match block from member variable
• Add SecArgumentsLimit, 200007 to modsecurity.conf-recommended
• Fix memory leak when concurrent log includes REMOTE_USER
• Fix LMDB initialization issues
• Fix initcol error message wording
• Tolerate other parameters after boundary in multipart C-T
• Add DebugLog message for bad pattern in rx operator
• Fix misuses of LMDB API
• Fix duplication typo in code comment
• Fix multiMatch msg, etc, population in audit log
• Fix some name handling for ARGS_*NAMES: regex SecRuleUpdateTargetById, etc.
• Adjust confusing variable name in setRequestBody method
• Multipart names/filenames may include single quote if double-quote enclosed
• Add SecRequestBodyJsonDepthLimit to modsecurity.conf-recommended

Update to version 3.0.6

• Security issue: Support configurable limit on depth of JSON parsing, possible DoS issue. CVE-2021-42717

Update to version 3.0.5

• New: Having ARGS_NAMES, variables proxied
• Fix: FILES variable does not use multipart part name for key
• GeoIP: switch to GEOIP_MEMORY_CACHE from GEOIP_INDEX_CACHE
• Support configurable limit on number of arguments processed
• Adds support to lua 5.4
• Add support for new operator rxGlobal
• Fix: Replaces put with setenv in SetEnv action
• Fix: Regex key selection should not be case-sensitive
• Fix: Only delete Multipart tmp files after rules have run
• Fixed MatchedVar on chained rules
• Fix IP address logging in Section A
• Fix: rx: exit after full match (remove /g emulation); ensure capture groups occuring after unused groups still populate TX vars
• Fix rule-update-target for…

This update for modsecurity fixes the following issues:

Update to version 3.0.10:

• Security impacting issue (fix boo#1213702, CVE-2023-38285)

  • Fix: worst-case time in implementation of four transformations
  • Additional information on this issue is available at https://www.trustwave.com/resources/blogs/spiderlabs-blog/modsecurity-v3-dos-vulnerability-in-four-transformations-cve-2023-38285/

• Enhancements and bug fixes

  • Add TX synonym for MSC_PCRE_LIMITS_EXCEEDED
  • Make MULTIPART_PART_HEADERS accessible to lua
  • Fix: Lua scripts cannot read whole collection at once
  • Fix: quoted Include config with wildcard
  • Support isolated PCRE match limits
  • Fix: meta actions not applied if multiMatch in first rule of chain
  • Fix: audit log may omit tags when multiMatch
  • Exclude CRLF from MULTIPART_PART_HEADER value
  • Configure: use AS_ECHO_N instead echo -n
  • Adjust position of memset from 2890

Update to version 3.0.9:

• Add some member variable inits in Transaction class (possible segfault)
• Fix: possible segfault on reload if duplicate ip+CIDR in ip match list
• Resolve memory leak on reload (bison-generated variable)
• Support equals sign in XPath expressions
• Encode two special chars in error.log output
• Add JIT support for PCRE2
• Support comments in ipMatchFromFile file via '#' token
• Use name package name libmaxminddb with pkg-config
• Fix: FILES_TMP_CONTENT collection key should use part name
• Use AS_HELP_STRING instead of obsolete AC_HELP_STRING macro
• During configure, do not check for pcre if pcre2 specified
• Use pkg-config to find libxml2 first
• Fix two rule-reload memory leak issues
• Correct whitespace handling for Include directive

• Fix CVE-2023-28882, a segfault and a resultant crash of a worker process in some configurations with certain inputs, boo#1210993

Update to version 3.0.8

• Adjust parser activation rules in modsecurity.conf-recommended [#2796]
• Multipart parsing fixes and new MULTIPART_PART_HEADERS collection [#2795]
• Prevent LMDB related segfault [#2755, #2761]
• Fix msc_transaction_cleanup function comment typo [#2788]
• Fix: MULTIPART_INVALID_PART connected to wrong internal variable [#2785]
• Restore Unique_id to include random portion after timestamp [#2752, #2758]

Update to version 3.0.7

• Support PCRE2
• Support SecRequestBodyNoFilesLimit
• Add ctl:auditEngine action support
• Move PCRE2 match block from member variable
• Add SecArgumentsLimit, 200007 to modsecurity.conf-recommended
• Fix memory leak when concurrent log includes REMOTE_USER
• Fix LMDB initialization issues
• Fix initcol error message wording
• Tolerate other parameters after boundary in multipart C-T
• Add DebugLog message for bad pattern in rx operator
• Fix misuses of LMDB API
• Fix duplication typo in code comment
• Fix multiMatch msg, etc, population in audit log
• Fix some name handling for ARGS_*NAMES: regex SecRuleUpdateTargetById, etc.
• Adjust confusing variable name in setRequestBody method
• Multipart names/filenames may include single quote if double-quote enclosed
• Add SecRequestBodyJsonDepthLimit to modsecurity.conf-recommended

Update to version 3.0.6

• Security issue: Support configurable limit on depth of JSON parsing, possible DoS issue. CVE-2021-42717

Update to version 3.0.5

• New: Having ARGS_NAMES, variables proxied
• Fix: FILES variable does not use multipart part name for key
• GeoIP: switch to GEOIP_MEMORY_CACHE from GEOIP_INDEX_CACHE
• Support configurable limit on number of arguments processed
• Adds support to lua 5.4
• Add support for new operator rxGlobal
• Fix: Replaces put with setenv in SetEnv action
• Fix: Regex key selection should not be case-sensitive
• Fix: Only delete Multipart tmp files after rules have run
• Fixed MatchedVar on chained rules
• Fix IP address logging in Section A
• Fix: rx: exit after full match (remove /g emulation); ensure capture groups occuring after unused groups still populate TX vars
• Fix rule-update-target for…

These are all security issues fixed in the libmodsecurity3-3.0.6-1.1 package on the GA media of openSUSE Tumbleweed.