CVE-2023-24021
In ModSecurity before 2.9.7, FILES_TMP_CONTENT sometimes lacked the complete content. This can...
Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web Application Firewall when executing rules that read the FILES_TMP_CONTENT collection.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web Application Firewall when executing rules that read the FILES_TMP_CONTENT collection.
- Record
CVE-2023-24021- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-170
- Updated
- 2026-11-02
CVE List
Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web Application Firewall when executing rules that read the FILES_TMP_CONTENT collection.
- Record
CVE-2023-24021- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-170
- Updated
- 2026-11-02
EUVDEUVD-2023-28085
Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web Application Firewall when executing rules that read the FILES_TMP_CONTENT collection.
- Record
EUVD-2023-28085- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-845r-7x4c-q8qf
In ModSecurity before 2.9.7, FILES_TMP_CONTENT sometimes lacked the complete content. This can...
In ModSecurity before 2.9.7, FILES_TMP_CONTENT sometimes lacked the complete content. This can lead to a Web Application Firewall bypass.
- Record
GHSA-845r-7x4c-q8qf- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-170
- Updated
- 2026-11-02
OSVAZL-43843
CVE-2023-24021 affecting package mod_security 2.9.4-1
Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web Application Firewall when executing rules that read the FILES_TMP_CONTENT collection.
- Record
AZL-43843- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVAZL-44475
CVE-2023-24021 affecting package mod_security for versions less than 2.9.7-8
Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web Application Firewall when executing rules that read the FILES_TMP_CONTENT collection.
- Record
AZL-44475- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 10 moreShow less
OSV
Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web Application Firewall when executing rules that read the FILES_TMP_CONTENT collection.
- Record
CVE-2023-24021- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-24021
Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web Application Firewall when executing rules that read the FILES_TMP_CONTENT collection.
- Record
DEBIAN-CVE-2023-24021- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2023:4629
Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 security update
- Record
RHSA-2023:4629- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-24021
Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web Application Firewall when executing rules that read the FILES_TMP_CONTENT collection.
- Record
UBUNTU-CVE-2023-24021- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVBIT-modsecurity-2023-24021 No score
Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web Application Firewall when executing rules that read the FILES_TMP_CONTENT collection.
- Record
BIT-modsecurity-2023-24021- Updated
- 2026-11-02
OSVBIT-modsecurity2-2023-24021 No score
Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web Application Firewall when executing rules that read the FILES_TMP_CONTENT collection.
- Record
BIT-modsecurity2-2023-24021- Updated
- 2026-11-02
OSVMGASA-2023-0175 No score
Updated apache-mod_security packages fix security vulnerability
HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall (CVE-2022-48279) Incorrect handling of '\0' bytes in file uploads in ModSecurity may allow for Web Application Firewall bypasses and buffer over-reads on the Web Application Firewall when executing rules that read the FILES_TMP_CONTENT collection. (CVE-2023-24021)
- Record
MGASA-2023-0175- Updated
- 2026-11-02
OSVSUSE-SU-2023:0431-1 No score
Security update for apache2-mod_security2
This update for apache2-mod_security2 fixes the following issues:
- CVE-2023-24021: Fixed FILES_TMP_CONTENT missing complete content (bsc#1207379).
- Record
SUSE-SU-2023:0431-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:0447-1 No score
Security update for apache2-mod_security2
This update for apache2-mod_security2 fixes the following issues:
- CVE-2023-24021: Fixed FILES_TMP_CONTENT missing complete content (bsc#1207379).
- Record
SUSE-SU-2023:0447-1- Updated
- 2026-11-02
OSVUSN-6370-1 No score
modsecurity-apache vulnerabilities
It was discovered that ModSecurity incorrectly handled certain nested JSON objects. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-42717)
It was discovered that ModSecurity incorrectly handled certain HTTP multipart requests. A remote attacker could possibly use this issue to bypass ModSecurity restrictions. (CVE-2022-48279)
It was discovered that ModSecurity incorrectly handled certain file uploads. A remote attacker could possibly use this issue to cause a buffer overflow and a firewall failure. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-24021)
- Record
USN-6370-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mod_securityAzure Linux:2 |
through 2.9.4-1 | None known |
mod_securityAzure Linux:3 |
before 2.9.7-8 | 2.9.7-8 |
modsecurityBitnami |
before 2.9.7 | 2.9.7 |
modsecurity2Bitnami |
before 2.9.7 | 2.9.7 |
modsecurity-apacheDebian:12 |
before 2.9.7-1 | 2.9.7-1 |
modsecurity-apacheDebian:13 |
before 2.9.7-1 | 2.9.7-1 |
modsecurity-apacheDebian:14 |
before 2.9.7-1 | 2.9.7-1 |
modsecurity-apacheDebian:10 From an advisory covering 2 CVEs |
before 2.9.3-1+deb10u2, plus listed versions 2.9.3-12.9.3-1+deb10u1 |
2.9.3-1+deb10u2 |
apache-mod_securityMageia:8 From an advisory covering 2 CVEs |
before 2.9.7-1.mga8 | 2.9.7-1.mga8 |
jbcs-httpd24-aprRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 0:1.7.0-8.el7jbcs | 0:1.7.0-8.el7jbcs |
Show 70 moreShow less
| Package | Affected | Fixed |
|---|---|---|
jbcs-httpd24-apr-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 0:1.7.0-8.el7jbcs | 0:1.7.0-8.el7jbcs |
jbcs-httpd24-apr-develRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 0:1.7.0-8.el7jbcs | 0:1.7.0-8.el7jbcs |
jbcs-httpd24-aprRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:1.7.0-8.el8jbcs | 0:1.7.0-8.el8jbcs |
jbcs-httpd24-apr-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:1.7.0-8.el8jbcs | 0:1.7.0-8.el8jbcs |
jbcs-httpd24-apr-develRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:1.7.0-8.el8jbcs | 0:1.7.0-8.el8jbcs |
jbcs-httpd24-httpdRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el7jbcs | 0:2.4.57-5.el7jbcs |
jbcs-httpd24-httpd-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el7jbcs | 0:2.4.57-5.el7jbcs |
jbcs-httpd24-httpd-develRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el7jbcs | 0:2.4.57-5.el7jbcs |
jbcs-httpd24-httpd-manualRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el7jbcs | 0:2.4.57-5.el7jbcs |
jbcs-httpd24-httpd-selinuxRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el7jbcs | 0:2.4.57-5.el7jbcs |
jbcs-httpd24-httpd-toolsRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el7jbcs | 0:2.4.57-5.el7jbcs |
jbcs-httpd24-mod_ldapRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el7jbcs | 0:2.4.57-5.el7jbcs |
jbcs-httpd24-mod_proxy_htmlRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 1:2.4.57-5.el7jbcs | 1:2.4.57-5.el7jbcs |
jbcs-httpd24-mod_sessionRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el7jbcs | 0:2.4.57-5.el7jbcs |
jbcs-httpd24-mod_sslRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 1:2.4.57-5.el7jbcs | 1:2.4.57-5.el7jbcs |
jbcs-httpd24-httpdRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el8jbcs | 0:2.4.57-5.el8jbcs |
jbcs-httpd24-httpd-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el8jbcs | 0:2.4.57-5.el8jbcs |
jbcs-httpd24-httpd-develRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el8jbcs | 0:2.4.57-5.el8jbcs |
jbcs-httpd24-httpd-manualRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el8jbcs | 0:2.4.57-5.el8jbcs |
jbcs-httpd24-httpd-selinuxRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el8jbcs | 0:2.4.57-5.el8jbcs |
jbcs-httpd24-httpd-toolsRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el8jbcs | 0:2.4.57-5.el8jbcs |
jbcs-httpd24-httpd-tools-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el8jbcs | 0:2.4.57-5.el8jbcs |
jbcs-httpd24-mod_ldapRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el8jbcs | 0:2.4.57-5.el8jbcs |
jbcs-httpd24-mod_ldap-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el8jbcs | 0:2.4.57-5.el8jbcs |
jbcs-httpd24-mod_proxy_htmlRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 1:2.4.57-5.el8jbcs | 1:2.4.57-5.el8jbcs |
jbcs-httpd24-mod_proxy_html-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 1:2.4.57-5.el8jbcs | 1:2.4.57-5.el8jbcs |
jbcs-httpd24-mod_sessionRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el8jbcs | 0:2.4.57-5.el8jbcs |
jbcs-httpd24-mod_session-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:2.4.57-5.el8jbcs | 0:2.4.57-5.el8jbcs |
jbcs-httpd24-mod_sslRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 1:2.4.57-5.el8jbcs | 1:2.4.57-5.el8jbcs |
jbcs-httpd24-mod_ssl-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 1:2.4.57-5.el8jbcs | 1:2.4.57-5.el8jbcs |
jbcs-httpd24-mod_securityRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 0:2.9.3-29.el7jbcs | 0:2.9.3-29.el7jbcs |
jbcs-httpd24-mod_security-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 0:2.9.3-29.el7jbcs | 0:2.9.3-29.el7jbcs |
jbcs-httpd24-mod_securityRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:2.9.3-29.el8jbcs | 0:2.9.3-29.el8jbcs |
jbcs-httpd24-mod_security-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:2.9.3-29.el8jbcs | 0:2.9.3-29.el8jbcs |
jbcs-httpd24-curlRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 0:8.2.1-1.el7jbcs | 0:8.2.1-1.el7jbcs |
jbcs-httpd24-curl-debuginfoRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 0:8.2.1-1.el7jbcs | 0:8.2.1-1.el7jbcs |
jbcs-httpd24-libcurlRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 0:8.2.1-1.el7jbcs | 0:8.2.1-1.el7jbcs |
jbcs-httpd24-libcurl-develRed Hat:jboss_core_services:1::el7 From an advisory covering 9 CVEs |
before 0:8.2.1-1.el7jbcs | 0:8.2.1-1.el7jbcs |
jbcs-httpd24-curlRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:8.2.1-1.el8jbcs | 0:8.2.1-1.el8jbcs |
jbcs-httpd24-curl-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:8.2.1-1.el8jbcs | 0:8.2.1-1.el8jbcs |
jbcs-httpd24-libcurlRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:8.2.1-1.el8jbcs | 0:8.2.1-1.el8jbcs |
jbcs-httpd24-libcurl-debuginfoRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:8.2.1-1.el8jbcs | 0:8.2.1-1.el8jbcs |
jbcs-httpd24-libcurl-develRed Hat:jboss_core_services:1::el8 From an advisory covering 9 CVEs |
before 0:8.2.1-1.el8jbcs | 0:8.2.1-1.el8jbcs |
apache2-mod_security2SUSE:Linux Enterprise Module for Server Applications 15 SP4 |
before 2.9.4-150400.3.6.1 | 2.9.4-150400.3.6.1 |
apache2-mod_security2openSUSE:Leap 15.4 |
before 2.9.4-150400.3.6.1 | 2.9.4-150400.3.6.1 |
apache2-mod_security2SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS |
before 2.9.2-150000.3.9.1 | 2.9.2-150000.3.9.1 |
apache2-mod_security2SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS |
before 2.9.2-150000.3.9.1 | 2.9.2-150000.3.9.1 |
apache2-mod_security2SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS |
before 2.9.2-150000.3.9.1 | 2.9.2-150000.3.9.1 |
apache2-mod_security2SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS |
before 2.9.2-150000.3.9.1 | 2.9.2-150000.3.9.1 |
apache2-mod_security2SUSE:Linux Enterprise Real Time 15 SP3 |
before 2.9.2-150000.3.9.1 | 2.9.2-150000.3.9.1 |
apache2-mod_security2SUSE:Linux Enterprise Server 15 SP1-LTSS |
before 2.9.2-150000.3.9.1 | 2.9.2-150000.3.9.1 |
apache2-mod_security2SUSE:Linux Enterprise Server 15 SP2-LTSS |
before 2.9.2-150000.3.9.1 | 2.9.2-150000.3.9.1 |
apache2-mod_security2SUSE:Linux Enterprise Server 15 SP3-LTSS |
before 2.9.2-150000.3.9.1 | 2.9.2-150000.3.9.1 |
apache2-mod_security2SUSE:Linux Enterprise Server for SAP Applications 15 SP1 |
before 2.9.2-150000.3.9.1 | 2.9.2-150000.3.9.1 |
apache2-mod_security2SUSE:Linux Enterprise Server for SAP Applications 15 SP2 |
before 2.9.2-150000.3.9.1 | 2.9.2-150000.3.9.1 |
apache2-mod_security2SUSE:Linux Enterprise Server for SAP Applications 15 SP3 |
before 2.9.2-150000.3.9.1 | 2.9.2-150000.3.9.1 |
apache2-mod_security2SUSE:Manager Proxy 4.2 |
before 2.9.2-150000.3.9.1 | 2.9.2-150000.3.9.1 |
apache2-mod_security2SUSE:Manager Retail Branch Server 4.2 |
before 2.9.2-150000.3.9.1 | 2.9.2-150000.3.9.1 |
apache2-mod_security2SUSE:Manager Server 4.2 |
before 2.9.2-150000.3.9.1 | 2.9.2-150000.3.9.1 |
apache2-mod_security2SUSE:Enterprise Storage 7 |
before 2.9.2-150000.3.9.1 | 2.9.2-150000.3.9.1 |
apache2-mod_security2SUSE:Enterprise Storage 7.1 |
before 2.9.2-150000.3.9.1 | 2.9.2-150000.3.9.1 |
modsecurity-apacheUbuntu:Pro:16.04:LTS |
before 2.9.0-1ubuntu0.1~esm1, plus listed versions 2.9.0-1 |
2.9.0-1ubuntu0.1~esm1 |
modsecurity-apacheUbuntu:Pro:18.04:LTS |
before 2.9.2-1ubuntu0.1~esm1, plus listed versions 2.9.1-32.9.2-1 |
2.9.2-1ubuntu0.1~esm1 |
modsecurity-apacheUbuntu:20.04:LTS |
before 2.9.3-1ubuntu0.1, plus listed versions 2.9.3-1 |
2.9.3-1ubuntu0.1 |
modsecurity-apacheUbuntu:Pro:22.04:LTS |
before 2.9.5-1ubuntu0.1~esm1, plus listed versions 2.9.3-32.9.5-1 |
2.9.5-1ubuntu0.1~esm1 |
modsecurity-apacheUbuntu:Pro:14.04:LTS From an advisory covering 3 CVEs |
before 2.7.7-2ubuntu0.1~esm1, plus listed versions 2.7.4-12.7.5-12.7.7-12.7.7-1ubuntu12.7.7-2 |
2.7.7-2ubuntu0.1~esm1 |
modsecurity-apacheUbuntu:Pro:16.04:LTS From an advisory covering 3 CVEs |
before 2.9.0-1ubuntu0.1~esm1, plus listed versions 2.9.0-1 |
2.9.0-1ubuntu0.1~esm1 |
modsecurity-apacheUbuntu:Pro:18.04:LTS From an advisory covering 3 CVEs |
before 2.9.2-1ubuntu0.1~esm1, plus listed versions 2.9.1-32.9.2-1 |
2.9.2-1ubuntu0.1~esm1 |
modsecurity-apacheUbuntu:20.04:LTS From an advisory covering 3 CVEs |
before 2.9.3-1ubuntu0.1, plus listed versions 2.9.3-1 |
2.9.3-1ubuntu0.1 |
modsecurity-apacheUbuntu:Pro:22.04:LTS From an advisory covering 3 CVEs |
before 2.9.5-1ubuntu0.1~esm1, plus listed versions 2.9.3-32.9.5-1 |
2.9.5-1ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-24021 is a high vulnerability (CVSS 7.5) in Trustwave Modsecurity, published January 20, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.93%, the 60th percentile. Fixed in mod_security 2.9.7-8.
References
github.com/SpiderLabs/ModSecurity/releases/tag/v2.9.7
lists.debian.org/debian-lts-announce/2023/01/msg00023.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WCH6JM4I4MD4YABYFHSBDDOUFDGIFJKL
Show 64 moreShow less
nvd.nist.gov/vuln/detail/CVE-2023-24021
security-tracker.debian.org/tracker/CVE-2023-24021
advisories.mageia.org/MGASA-2023-0175.html
bugs.mageia.org/show_bug.cgi?id=31457
debian.org/lts/security/2023/dla-3283
access.redhat.com/errata/RHSA-2023:4629
bugzilla.redhat.com/show_bug.cgi?id=2161773
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_4629.json
cve.org/CVERecord?id=CVE-2022-24963
lists.apache.org/thread/fw9p6sdncwsjkstwc066vz57xqzfksq9
httpd.apache.org/security/vulnerabilities_24.html
curl.se/docs/CVE-2023-28319.html
suse.com/support/update/announcement/2023/suse-su-20230431-1
bugzilla.suse.com/1207379
ubuntu.com/security/CVE-2023-24021