CVE-2021-42717

ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web server being unable to service legitimate requests. Even a moderately large (e.g., 300KB) HTTP request can occupy one of the limited NGINX worker processes for minutes and consume almost all of the available CPU on the machine. Modsecurity 2 is similarly vulnerable: the affected versions include 2.8.0 through 2.9.4.

This software is also called Modsec,it is an open-source web application firewall. It is designed for Apache HTTP Server.ModSecurity is commonly deployed to provide protections against generic classed of vulnerabilities.The install of this package is easy and you can read the README.TXT for more information.

Security Fix(es):

ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web server being unable to service legitimate requests. Even a moderately large (e.g., 300KB) HTTP request can occupy one of the limited NGINX worker processes for minutes and consume almost all of the available CPU on the machine. Modsecurity 2 is similarly vulnerable: the affected versions include 2.8.0 through 2.9.4.(CVE-2021-42717)

This software is also called Modsec,it is an open-source web application firewall. It is designed for Apache HTTP Server.ModSecurity is commonly deployed to provide protections against generic classed of vulnerabilities.The install of this package is easy and you can read the README.TXT for more information.

Security Fix(es):

ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web server being unable to service legitimate requests. Even a moderately large (e.g., 300KB) HTTP request can occupy one of the limited NGINX worker processes for minutes and consume almost all of the available CPU on the machine. Modsecurity 2 is similarly vulnerable: the affected versions include 2.8.0 through 2.9.4.(CVE-2021-42717)

ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web server being unable to service legitimate requests. Even a moderately large (e.g., 300KB) HTTP request can occupy one of the limited NGINX worker processes for minutes and consume almost all of the available CPU on the machine. Modsecurity 2 is similarly vulnerable: the affected versions include 2.8.0 through 2.9.4.

ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web server being unable to service legitimate requests. Even a moderately large (e.g., 300KB) HTTP request can occupy one of the limited NGINX worker processes for minutes and consume almost all of the available CPU on the machine. Modsecurity 2 is similarly vulnerable: the affected versions include 2.8.0 through 2.9.4.

ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web server being unable to service legitimate requests. Even a moderately large (e.g., 300KB) HTTP request can occupy one of the limited NGINX worker processes for minutes and consume almost all of the available CPU on the machine. Modsecurity 2 is similarly vulnerable: the affected versions include 2.8.0 through 2.9.4.

Updated apache-mod_security packages fix security vulnerability:

ModSecurity mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web server being unable to service legitimate requests. Even a moderately large (e.g., 300KB) HTTP request can occupy one of the limited NGINX worker processes for minutes and consume almost all of the available CPU on the machine (CVE-2021-42717).

This update for modsecurity fixes the following issues:

Update to version 3.0.10:

• Security impacting issue (fix boo#1213702, CVE-2023-38285)

  • Fix: worst-case time in implementation of four transformations
  • Additional information on this issue is available at https://www.trustwave.com/resources/blogs/spiderlabs-blog/modsecurity-v3-dos-vulnerability-in-four-transformations-cve-2023-38285/

• Enhancements and bug fixes

  • Add TX synonym for MSC_PCRE_LIMITS_EXCEEDED
  • Make MULTIPART_PART_HEADERS accessible to lua
  • Fix: Lua scripts cannot read whole collection at once
  • Fix: quoted Include config with wildcard
  • Support isolated PCRE match limits
  • Fix: meta actions not applied if multiMatch in first rule of chain
  • Fix: audit log may omit tags when multiMatch
  • Exclude CRLF from MULTIPART_PART_HEADER value
  • Configure: use AS_ECHO_N instead echo -n
  • Adjust position of memset from 2890

Update to version 3.0.9:

• Add some member variable inits in Transaction class (possible segfault)
• Fix: possible segfault on reload if duplicate ip+CIDR in ip match list
• Resolve memory leak on reload (bison-generated variable)
• Support equals sign in XPath expressions
• Encode two special chars in error.log output
• Add JIT support for PCRE2
• Support comments in ipMatchFromFile file via '#' token
• Use name package name libmaxminddb with pkg-config
• Fix: FILES_TMP_CONTENT collection key should use part name
• Use AS_HELP_STRING instead of obsolete AC_HELP_STRING macro
• During configure, do not check for pcre if pcre2 specified
• Use pkg-config to find libxml2 first
• Fix two rule-reload memory leak issues
• Correct whitespace handling for Include directive

• Fix CVE-2023-28882, a segfault and a resultant crash of a worker process in some configurations with certain inputs, boo#1210993

Update to version 3.0.8

• Adjust parser activation rules in modsecurity.conf-recommended [#2796]
• Multipart parsing fixes and new MULTIPART_PART_HEADERS collection [#2795]
• Prevent LMDB related segfault [#2755, #2761]
• Fix msc_transaction_cleanup function comment typo [#2788]
• Fix: MULTIPART_INVALID_PART connected to wrong internal variable [#2785]
• Restore Unique_id to include random portion after timestamp [#2752, #2758]

Update to version 3.0.7

• Support PCRE2
• Support SecRequestBodyNoFilesLimit
• Add ctl:auditEngine action support
• Move PCRE2 match block from member variable
• Add SecArgumentsLimit, 200007 to modsecurity.conf-recommended
• Fix memory leak when concurrent log includes REMOTE_USER
• Fix LMDB initialization issues
• Fix initcol error message wording
• Tolerate other parameters after boundary in multipart C-T
• Add DebugLog message for bad pattern in rx operator
• Fix misuses of LMDB API
• Fix duplication typo in code comment
• Fix multiMatch msg, etc, population in audit log
• Fix some name handling for ARGS_*NAMES: regex SecRuleUpdateTargetById, etc.
• Adjust confusing variable name in setRequestBody method
• Multipart names/filenames may include single quote if double-quote enclosed
• Add SecRequestBodyJsonDepthLimit to modsecurity.conf-recommended

Update to version 3.0.6

• Security issue: Support configurable limit on depth of JSON parsing, possible DoS issue. CVE-2021-42717

Update to version 3.0.5

• New: Having ARGS_NAMES, variables proxied
• Fix: FILES variable does not use multipart part name for key
• GeoIP: switch to GEOIP_MEMORY_CACHE from GEOIP_INDEX_CACHE
• Support configurable limit on number of arguments processed
• Adds support to lua 5.4
• Add support for new operator rxGlobal
• Fix: Replaces put with setenv in SetEnv action
• Fix: Regex key selection should not be case-sensitive
• Fix: Only delete Multipart tmp files after rules have run
• Fixed MatchedVar on chained rules
• Fix IP address logging in Section A
• Fix: rx: exit after full match (remove /g emulation); ensure capture groups occuring after unused groups still populate TX vars
• Fix rule-update-target for…

This update for modsecurity fixes the following issues:

Update to version 3.0.10:

• Security impacting issue (fix boo#1213702, CVE-2023-38285)

  • Fix: worst-case time in implementation of four transformations
  • Additional information on this issue is available at https://www.trustwave.com/resources/blogs/spiderlabs-blog/modsecurity-v3-dos-vulnerability-in-four-transformations-cve-2023-38285/

• Enhancements and bug fixes

  • Add TX synonym for MSC_PCRE_LIMITS_EXCEEDED
  • Make MULTIPART_PART_HEADERS accessible to lua
  • Fix: Lua scripts cannot read whole collection at once
  • Fix: quoted Include config with wildcard
  • Support isolated PCRE match limits
  • Fix: meta actions not applied if multiMatch in first rule of chain
  • Fix: audit log may omit tags when multiMatch
  • Exclude CRLF from MULTIPART_PART_HEADER value
  • Configure: use AS_ECHO_N instead echo -n
  • Adjust position of memset from 2890

Update to version 3.0.9:

• Add some member variable inits in Transaction class (possible segfault)
• Fix: possible segfault on reload if duplicate ip+CIDR in ip match list
• Resolve memory leak on reload (bison-generated variable)
• Support equals sign in XPath expressions
• Encode two special chars in error.log output
• Add JIT support for PCRE2
• Support comments in ipMatchFromFile file via '#' token
• Use name package name libmaxminddb with pkg-config
• Fix: FILES_TMP_CONTENT collection key should use part name
• Use AS_HELP_STRING instead of obsolete AC_HELP_STRING macro
• During configure, do not check for pcre if pcre2 specified
• Use pkg-config to find libxml2 first
• Fix two rule-reload memory leak issues
• Correct whitespace handling for Include directive

• Fix CVE-2023-28882, a segfault and a resultant crash of a worker process in some configurations with certain inputs, boo#1210993

Update to version 3.0.8

• Adjust parser activation rules in modsecurity.conf-recommended [#2796]
• Multipart parsing fixes and new MULTIPART_PART_HEADERS collection [#2795]
• Prevent LMDB related segfault [#2755, #2761]
• Fix msc_transaction_cleanup function comment typo [#2788]
• Fix: MULTIPART_INVALID_PART connected to wrong internal variable [#2785]
• Restore Unique_id to include random portion after timestamp [#2752, #2758]

Update to version 3.0.7

• Support PCRE2
• Support SecRequestBodyNoFilesLimit
• Add ctl:auditEngine action support
• Move PCRE2 match block from member variable
• Add SecArgumentsLimit, 200007 to modsecurity.conf-recommended
• Fix memory leak when concurrent log includes REMOTE_USER
• Fix LMDB initialization issues
• Fix initcol error message wording
• Tolerate other parameters after boundary in multipart C-T
• Add DebugLog message for bad pattern in rx operator
• Fix misuses of LMDB API
• Fix duplication typo in code comment
• Fix multiMatch msg, etc, population in audit log
• Fix some name handling for ARGS_*NAMES: regex SecRuleUpdateTargetById, etc.
• Adjust confusing variable name in setRequestBody method
• Multipart names/filenames may include single quote if double-quote enclosed
• Add SecRequestBodyJsonDepthLimit to modsecurity.conf-recommended

Update to version 3.0.6

• Security issue: Support configurable limit on depth of JSON parsing, possible DoS issue. CVE-2021-42717

Update to version 3.0.5

• New: Having ARGS_NAMES, variables proxied
• Fix: FILES variable does not use multipart part name for key
• GeoIP: switch to GEOIP_MEMORY_CACHE from GEOIP_INDEX_CACHE
• Support configurable limit on number of arguments processed
• Adds support to lua 5.4
• Add support for new operator rxGlobal
• Fix: Replaces put with setenv in SetEnv action
• Fix: Regex key selection should not be case-sensitive
• Fix: Only delete Multipart tmp files after rules have run
• Fixed MatchedVar on chained rules
• Fix IP address logging in Section A
• Fix: rx: exit after full match (remove /g emulation); ensure capture groups occuring after unused groups still populate TX vars
• Fix rule-update-target for…

These are all security issues fixed in the libmodsecurity3-3.0.6-1.1 package on the GA media of openSUSE Tumbleweed.

It was discovered that ModSecurity incorrectly handled certain nested JSON objects. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-42717)

It was discovered that ModSecurity incorrectly handled certain HTTP multipart requests. A remote attacker could possibly use this issue to bypass ModSecurity restrictions. (CVE-2022-48279)

It was discovered that ModSecurity incorrectly handled certain file uploads. A remote attacker could possibly use this issue to cause a buffer overflow and a firewall failure. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-24021)