{"id":"CVE-2023-28882","aliases":["BIT-modsecurity-2023-28882","BIT-modsecurity2-2023-28882","DEBIAN-CVE-2023-28882","EUVD-2023-32502","GHSA-wgcm-rvmx-wh95","UBUNTU-CVE-2023-28882","openSUSE-SU-2023:0257-1","openSUSE-SU-2023:0269-1","openSUSE-SU-2024:12937-1"],"status":"published","title":"Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash...","description":"Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness) because some inputs cause a segfault in the Transaction class for some configurations.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00731,"percentile":0.54559,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-770"],"published":"2023-04-28T00:00:00Z","modified":"2026-10-28T02:31:14Z","fixes":[{"ecosystem":"Bitnami","package":"modsecurity","fixed_in":["3.0.9"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"modsecurity2","fixed_in":["3.0.9"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"modsecurity","fixed_in":["3.0.9-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"modsecurity","fixed_in":["3.0.9-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"modsecurity","fixed_in":["3.0.9-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"modsecurity","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.5"},{"fixed":"3.0.9"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"modsecurity2","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.5"},{"fixed":"3.0.9"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"modsecurity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"modsecurity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"modsecurity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.9-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"modsecurity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.3-1","3.0.4-1","3.0.4-1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"modsecurity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.4-2","3.0.6-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"modsecurity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.10-1","3.0.11-1","3.0.12-1","3.0.12-1.1build1","3.0.12-1.1build2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"modsecurity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.13-1","3.0.14-1","3.0.14-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"modsecurity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.14-1build2","3.0.15-1","3.0.16-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"modsecurity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.14-1build1","3.0.14-1build2"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"modsecurity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.10-bp155.3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"modsecurity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.10-bp155.3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"modsecurity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.10-bp154.2.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"modsecurity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.10-bp154.2.3.1"}]}],"bundled":4}],"products":[{"vendor":"owasp","product":"modsecurity"}],"references":[{"url":"https://www.trustwave.com/en-us/resources/security-resources/software-updates/announcing-modsecurity-version-309/","tags":["x_transferred","Release Notes","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28882","tags":["web","advisory"]},{"url":"https://www.trustwave.com/en-us/resources/security-resources/software-updates/announcing-modsecurity-version-309"},{"url":"https://github.com/advisories/GHSA-wgcm-rvmx-wh95"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28882.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-28882","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-28882","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-28882","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LIQVEGVX3JPH6JWIVOQVDUI4WMZNSIG4/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1210993","tags":["report"]},{"url":"https://bugzilla.suse.com/1213702","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-38285","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ILAHCTDLNZCBSVGSQN2ZDHVDHYE2OZ2N/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-28882","description":"Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness) because some inputs cause a segfault in the Transaction class for some configurations.","status":"published","published":"2023-04-28T00:00:00Z","modified":"2025-01-30T20:42:27.303Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:35:32.752775Z"}],"euvd":[{"id":"EUVD-2023-32502","description":"Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness) because some inputs cause a segfault in the Transaction class for some configurations.","status":"published","published":"2023-04-28T00:00:00Z","modified":"2025-01-30T20:42:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:04:08.578338Z"}],"ghsa":[{"id":"GHSA-wgcm-rvmx-wh95","title":"Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash...","description":"Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness) because some inputs cause a segfault in the Transaction class for some configurations.","status":"published","published":"2023-04-28T06:30:21Z","modified":"2025-01-30T21:31:20Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:59:43.882222Z"}],"nvd":[{"id":"CVE-2023-28882","description":"Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness) because some inputs cause a segfault in the Transaction class for some configurations.","status":"published","published":"2023-04-28T04:15:38.017Z","modified":"2026-06-17T05:48:58.72Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:07:59.151142Z"}],"osv":[{"id":"CVE-2023-28882","description":"Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness) because some inputs cause a segfault in the Transaction class for some configurations.","status":"published","published":"2023-04-28T00:00:00Z","modified":"2026-10-28T02:31:14.568952619Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:31.468318Z"},{"id":"DEBIAN-CVE-2023-28882","description":"Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness) because some inputs cause a segfault in the Transaction class for some configurations.","status":"published","published":"2023-04-28T04:15:38.017Z","modified":"2026-10-26T18:01:40.29229158Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.679062Z"},{"id":"UBUNTU-CVE-2023-28882","description":"Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness) because some inputs cause a segfault in the Transaction class for some configurations.","status":"published","published":"2023-04-28T04:15:00Z","modified":"2026-10-17T12:57:17.784094896Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:20.997471Z"},{"id":"BIT-modsecurity-2023-28882","description":"Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness) because some inputs cause a segfault in the Transaction class for some configurations.","status":"published","published":"2024-03-06T10:56:32.385Z","modified":"2025-04-03T14:40:37.652Z","updated_at":"2026-11-02T15:28:33.072289Z"},{"id":"BIT-modsecurity2-2023-28882","description":"Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness) because some inputs cause a segfault in the Transaction class for some configurations.","status":"published","published":"2024-03-06T10:56:39.666Z","modified":"2025-04-03T14:40:37.652Z","updated_at":"2026-11-02T15:28:33.072289Z"},{"id":"openSUSE-SU-2023:0257-1","title":"Security update for modsecurity","description":"This update for modsecurity fixes the following issues:\n\nUpdate to version 3.0.10:\n\n* Security impacting issue (fix boo#1213702, CVE-2023-38285)\n\n  - Fix: worst-case time in implementation of four transformations\n  - Additional information on this issue is available at \n    https://www.trustwave.com/resources/blogs/spiderlabs-blog/modsecurity-v3-dos-vulnerability-in-four-transformations-cve-2023-38285/\n\n* Enhancements and bug fixes\n  - Add TX synonym for MSC_PCRE_LIMITS_EXCEEDED\n  - Make MULTIPART_PART_HEADERS accessible to lua\n  - Fix: Lua scripts cannot read whole collection at once\n  - Fix: quoted Include config with wildcard\n  - Support isolated PCRE match limits\n  - Fix: meta actions not applied if multiMatch in first rule of chain\n  - Fix: audit log may omit tags when multiMatch\n  - Exclude CRLF from MULTIPART_PART_HEADER value\n  - Configure: use AS_ECHO_N instead echo -n\n  - Adjust position of memset from 2890\n\nUpdate to version 3.0.9:\n\n* Add some member variable inits in Transaction class (possible segfault)\n* Fix: possible segfault on reload if duplicate ip+CIDR in ip match list\n* Resolve memory leak on reload (bison-generated variable)\n* Support equals sign in XPath expressions\n* Encode two special chars in error.log output\n* Add JIT support for PCRE2\n* Support comments in ipMatchFromFile file via '#' token\n* Use name package name libmaxminddb with pkg-config\n* Fix: FILES_TMP_CONTENT collection key should use part name\n* Use AS_HELP_STRING instead of obsolete AC_HELP_STRING macro\n* During configure, do not check for pcre if pcre2 specified\n* Use pkg-config to find libxml2 first\n* Fix two rule-reload memory leak issues\n* Correct whitespace handling for Include directive\n\n- Fix CVE-2023-28882, a segfault and a resultant crash of a worker process\n  in some configurations with certain inputs, boo#1210993\n\nUpdate to version 3.0.8\n\n* Adjust parser activation rules in modsecurity.conf-recommended [#2796]\n* Multipart parsing fixes and new MULTIPART_PART_HEADERS collection [#2795]\n* Prevent LMDB related segfault [#2755, #2761]\n* Fix msc_transaction_cleanup function comment typo [#2788]\n* Fix: MULTIPART_INVALID_PART connected to wrong internal variable [#2785]\n* Restore Unique_id to include random portion after timestamp [#2752, #2758]\n\nUpdate to version 3.0.7\n\n* Support PCRE2\n* Support SecRequestBodyNoFilesLimit\n* Add ctl:auditEngine action support\n* Move PCRE2 match block from member variable\n* Add SecArgumentsLimit, 200007 to modsecurity.conf-recommended\n* Fix memory leak when concurrent log includes REMOTE_USER\n* Fix LMDB initialization issues\n* Fix initcol error message wording\n* Tolerate other parameters after boundary in multipart C-T\n* Add DebugLog message for bad pattern in rx operator\n* Fix misuses of LMDB API\n* Fix duplication typo in code comment\n* Fix multiMatch msg, etc, population in audit log\n* Fix some name handling for ARGS_*NAMES: regex SecRuleUpdateTargetById, etc.\n* Adjust confusing variable name in setRequestBody method\n* Multipart names/filenames may include single quote if double-quote enclosed\n* Add SecRequestBodyJsonDepthLimit to modsecurity.conf-recommended\n\nUpdate to version 3.0.6\n\n* Security issue: Support configurable limit on depth of JSON\n  parsing, possible DoS issue. CVE-2021-42717\n\nUpdate to version 3.0.5\n\n* New: Having ARGS_NAMES, variables proxied\n* Fix: FILES variable does not use multipart part name for key\n* GeoIP: switch to GEOIP_MEMORY_CACHE from GEOIP_INDEX_CACHE\n* Support configurable limit on number of arguments processed\n* Adds support to lua 5.4\n* Add support for new operator rxGlobal\n* Fix: Replaces put with setenv in SetEnv action\n* Fix: Regex key selection should not be case-sensitive\n* Fix: Only delete Multipart tmp files after rules have run\n* Fixed MatchedVar on chained rules\n* Fix IP address logging in Section A\n* Fix:  rx: exit after full match (remove /g emulation); ensure\n  capture groups occuring after unused groups still populate TX vars\n* Fix rule-update-target for non-regex\n* Fix Security Impacting Issues:\n* Handle URI received with uri-fragment, CVE-2020-15598\n\nupdate to 3.0.4:\n\n* Fix: audit log data omitted when nolog,auditlog\n* Fix: ModSecurity 3.x inspectFile operator does not pass\n* XML: Remove error messages from stderr\n* Filter comment or blank line for pmFromFile operator\n* Additional adjustment to Cookie header parsing\n* Restore chained rule part H logging to be more like 2.9 behaviour\n* Small fixes in log messages to help debugging the file upload\n* Fix Cookie header parsing issues\n* Fix rules with nolog are logging to part H\n* Fix argument key-value pair parsing cases\n* Fix: audit log part for response body for JSON format to be E\n* Make sure m_rulesMessages is filled after successfull match\n* Fix @pm lookup for possible matches on offset zero.\n* Regex lookup on the key name instead of COLLECTION:key\n* Missing throw in Operator::instantiate\n* Making block action execution dependent of the SecEngine status\n* Making block action execution dependent of the SecEngine status\n* Having body limits to respect the rule engine state\n* Fix SecRuleUpdateTargetById does not match regular expressions\n* Adds missing check for runtime ctl:ruleRemoveByTag\n* Adds a new operator verifySVNR that checks for Austrian social security numbers.\n* Fix variables output in debug logs\n* Correct typo validade in log output\n* fix/minor: Error encoding hexa decimal.\n* Limit more log variables to 200 characters.\n* parser: fix parsed file names\n* Allow empty anchored variable\n* Fixed FILES_NAMES collection after the end of multipart parsing\n* Fixed validateByteRange parsing method\n* Removes a memory leak on the JSON parser\n* Enables LMDB on the regression tests.\n* Fix: Extra whitespace in some configuration directives causing error\n* Refactoring on Regex and SMatch classes.\n* Fixed buffer overflow in Utils::Md5::hexdigest()\n* Implemented merge() method for ConfigInt, ConfigDouble, ConfigString\n* Adds initially support to the drop action.\n* Complete merging of particular rule properties\n* Replaces AC_CHECK_FILE with 'test -f'\n* Fix inet addr handling on 64 bit big endian systems\n* Fix tests on FreeBSD\n* Changes ENV test case to read the default MODSECURTIY env var\n* Regression: Sets MODSECURITY env var during the tests execution\n* Fix setenv action to strdup key=variable\n* Allow 0 length JSON requests.\n* Fix 'make dist' target to include default configuration\n* Replaced log locking using mutex with fcntl lock\n* Correct the usage of modsecurity::Phases::NUMBER_OF_PHASES\n* Adds support to multiple ranges in ctl:ruleRemoveById\n* Rule variable interpolation broken\n* Make the boundary check less strict as per RFC2046\n* Fix buffer size for utf8toUnicode transformation\n* Fix double macros bug\n* Override the default status code if not suitable to redirect action\n* parser: Fix the support for CRLF configuration files\n* Organizes the server logs\n* m_lineNumber in Rule not mapping with the correct line number in file\n* Using shared_ptr instead of unique_ptr on rules exceptions\n* Changes debuglogs schema to avoid unecessary str allocation\n* Fix the SecUnicodeMapFile and SecUnicodeCodePage\n* Changes the timing to save the rule message\n* Fix crash in msc_rules_add_file() when using disruptive action in chain\n* Fix memory leak in AuditLog::init()\n* Fix RulesProperties::appendRules()\n* Fix RULE lookup in chained rules\n* @ipMatch 'Could not add entry' on slash/32 notation in 2.9.0\n* Using values after transformation at MATCHED_VARS\n* Adds support to UpdateActionById.\n* Add correct C function prototypes for msc_init and msc_create_rule_set\n* Allow LuaJIT 2.1 to be used\n* Match m_id JSON log with RuleMessage and v2 format\n* Adds support to setenv action.\n* Adds new transaction constructor that accepts the transaction id as parameter.\n* Adds request IDs and URIs to the debug log\n* Treating variables exception on load-time instead of run time.\n* Fix: function m.setvar in Lua scripts and add testcases\n* Fix SecResponseBodyAccess and ctl:requestBodyAccess directives\n* Fix OpenBSD build\n* Fix parser to support GeoLookup with MaxMind\n* parser: Fix simple quote setvar in the end of the line\n* Fix pc file\n* modsec_rules_check: uses the gnu `.la' instead of `.a' file\n* good practices: Initialize variables before use it\n* Fix utf-8 character encoding conversion\n* Adds support for ctl:requestBodyProcessor=URLENCODED\n* Add LUA compatibility for CentOS and try to use LuaJIT first if available\n* Allow LuaJIT to be used\n* Implement support for Lua 5.1\n* Variable names must match fully, not partially. Match should be case insensitive.\n* Improves the performance while loading the rules\n* Allow empty strings to be evaluated by regex::searchAll\n* Adds basic pkg-config info\n* Fixed LMDB collection errors\n* Fixed false positive MULTIPART_UNMATCHED_BOUNDARY errors\n* Fix ip tree lookup on netmask content\n* Changes the behavior of the default sec actions\n* Refactoring on {global,ip,resources,session,tx,user} collections\n* Fix race condition in UniqueId::uniqueId()\n* Fix memory leak in error message for msc_rules_merge C APIs\n* Return false in SharedFiles::open() when an error happens\n* Use rvalue reference in ModSecurity::serverLog\n* Build System: Fix when multiple lines for curl version.\n* Checks if response body inspection is enabled before process it\n* Fix setvar parsing of quoted data\n* Adds time stamp back to the audit logs\n* Disables skip counter if debug log is disabled\n* Cosmetics: Represents amount of skipped rules without decimal\n* Add missing escapeSeqDecode, urlEncode and trimLeft/Right tfns to parser\n* Fix STATUS var parsing and accept STATUS_LINE var for v2 backward comp.\n* Fix memory leak in modsecurity::utils::expandEnv()\n* Initialize m_dtd member in ValidateDTD class as NULL\n* Fix broken @detectxss operator regression test case\n* Fix utils::string::ssplit() to handle delimiter in the end of string\n* Fix variable FILES_TMPNAMES \n* Fix memory leak in Collections\n* Fix lib version information while generating the .so file\n* Adds support for ctl:ruleRemoveByTag\n* Fix SecUploadDir configuration merge\n* Include all prerequisites for 'make check' into dist archive\n* Fix: Reverse logic of checking output in @inspectFile\n* Adds support to libMaxMind\n* Adds capture action to detectXSS\n* Temporarily accept invalid MULTIPART_SEMICOLON_MISSING operator\n* Adds capture action to detectSQLi\n* Adds capture action to rbl\n* Adds capture action to verifyCC\n* Adds capture action to verifySSN\n* Adds capture action to verifyCPF\n* Prettier error messages for unsupported configurations (UX)\n* Add missing verify*** transformation statements to parser\n* Fix a set of compilation warnings\n* Check for disruptive action on SecDefaultAction.\n* Fix block-block infinite loop.\n* Correction remove_by_tag and remove_by_msg logic.\n* Fix LMDB compile error\n* Fix msc_who_am_i() to return pointer to a valid C string\n* Added some cosmetics to autoconf related code\n* Fix 'make dist' target to include necessary headers for Lua\n* Fix 'include /foo/*.conf' for single matched object in directory\n* Add missing Base64 transformation statements to parser\n* Fixed resource load on ip match from file\n* Fixed examples compilation while using disable-shared\n* Fixed compilation issue while xml is disabled\n* Having LDADD and LDFLAGS organized on Makefile.am\n* Checking std::deque size before use it\n* perf improvement: Added the concept of RunTimeString and removed all run time parser.\n* perf improvement: Checks debuglog level before format debug msg\n* perf. improvement/rx: Only compute dynamic regex in case of macro\n* Fix uri on the benchmark utility\n* disable Lua on systems with liblua5.1\n","status":"published","published":"2023-09-25T12:02:08Z","modified":"2026-02-04T04:33:12.316065Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2023:0269-1","title":"Security update for modsecurity","description":"This update for modsecurity fixes the following issues:\n\nUpdate to version 3.0.10:\n\n* Security impacting issue (fix boo#1213702, CVE-2023-38285)\n\n  - Fix: worst-case time in implementation of four transformations\n  - Additional information on this issue is available at \n    https://www.trustwave.com/resources/blogs/spiderlabs-blog/modsecurity-v3-dos-vulnerability-in-four-transformations-cve-2023-38285/\n\n* Enhancements and bug fixes\n\n  - Add TX synonym for MSC_PCRE_LIMITS_EXCEEDED\n  - Make MULTIPART_PART_HEADERS accessible to lua\n  - Fix: Lua scripts cannot read whole collection at once\n  - Fix: quoted Include config with wildcard\n  - Support isolated PCRE match limits\n  - Fix: meta actions not applied if multiMatch in first rule of chain\n  - Fix: audit log may omit tags when multiMatch\n  - Exclude CRLF from MULTIPART_PART_HEADER value\n  - Configure: use AS_ECHO_N instead echo -n\n  - Adjust position of memset from 2890\n\nUpdate to version 3.0.9:\n\n* Add some member variable inits in Transaction class (possible segfault)\n* Fix: possible segfault on reload if duplicate ip+CIDR in ip match list\n* Resolve memory leak on reload (bison-generated variable)\n* Support equals sign in XPath expressions\n* Encode two special chars in error.log output\n* Add JIT support for PCRE2\n* Support comments in ipMatchFromFile file via '#' token\n* Use name package name libmaxminddb with pkg-config\n* Fix: FILES_TMP_CONTENT collection key should use part name\n* Use AS_HELP_STRING instead of obsolete AC_HELP_STRING macro\n* During configure, do not check for pcre if pcre2 specified\n* Use pkg-config to find libxml2 first\n* Fix two rule-reload memory leak issues\n* Correct whitespace handling for Include directive\n- Fix CVE-2023-28882, a segfault and a resultant crash of a worker process\n  in some configurations with certain inputs, boo#1210993\n\nUpdate to version 3.0.8\n\n* Adjust parser activation rules in modsecurity.conf-recommended [#2796]\n* Multipart parsing fixes and new MULTIPART_PART_HEADERS collection [#2795]\n* Prevent LMDB related segfault [#2755, #2761]\n* Fix msc_transaction_cleanup function comment typo [#2788]\n* Fix: MULTIPART_INVALID_PART connected to wrong internal variable [#2785]\n* Restore Unique_id to include random portion after timestamp [#2752, #2758]\n\nUpdate to version 3.0.7\n\n* Support PCRE2\n* Support SecRequestBodyNoFilesLimit\n* Add ctl:auditEngine action support\n* Move PCRE2 match block from member variable\n* Add SecArgumentsLimit, 200007 to modsecurity.conf-recommended\n* Fix memory leak when concurrent log includes REMOTE_USER\n* Fix LMDB initialization issues\n* Fix initcol error message wording\n* Tolerate other parameters after boundary in multipart C-T\n* Add DebugLog message for bad pattern in rx operator\n* Fix misuses of LMDB API\n* Fix duplication typo in code comment\n* Fix multiMatch msg, etc, population in audit log\n* Fix some name handling for ARGS_*NAMES: regex SecRuleUpdateTargetById, etc.\n* Adjust confusing variable name in setRequestBody method\n* Multipart names/filenames may include single quote if double-quote enclosed\n* Add SecRequestBodyJsonDepthLimit to modsecurity.conf-recommended\n\nUpdate to version 3.0.6\n\n* Security issue: Support configurable limit on depth of JSON\n  parsing, possible DoS issue. CVE-2021-42717\n\nUpdate to version 3.0.5\n\n* New: Having ARGS_NAMES, variables proxied\n* Fix: FILES variable does not use multipart part name for key\n* GeoIP: switch to GEOIP_MEMORY_CACHE from GEOIP_INDEX_CACHE\n* Support configurable limit on number of arguments processed\n* Adds support to lua 5.4\n* Add support for new operator rxGlobal\n* Fix: Replaces put with setenv in SetEnv action\n* Fix: Regex key selection should not be case-sensitive\n* Fix: Only delete Multipart tmp files after rules have run\n* Fixed MatchedVar on chained rules\n* Fix IP address logging in Section A\n* Fix:  rx: exit after full match (remove /g emulation); ensure\n  capture groups occuring after unused groups still populate TX vars\n* Fix rule-update-target for non-regex\n* Fix Security Impacting Issues:\n* Handle URI received with uri-fragment, CVE-2020-15598\n\nUpdate to version 3.0.4:\n\n* Fix: audit log data omitted when nolog,auditlog\n* Fix: ModSecurity 3.x inspectFile operator does not pass\n* XML: Remove error messages from stderr\n* Filter comment or blank line for pmFromFile operator\n* Additional adjustment to Cookie header parsing\n* Restore chained rule part H logging to be more like 2.9 behaviour\n* Small fixes in log messages to help debugging the file upload\n* Fix Cookie header parsing issues\n* Fix rules with nolog are logging to part H\n* Fix argument key-value pair parsing cases\n* Fix: audit log part for response body for JSON format to be E\n* Make sure m_rulesMessages is filled after successfull match\n* Fix @pm lookup for possible matches on offset zero.\n* Regex lookup on the key name instead of COLLECTION:key\n* Missing throw in Operator::instantiate\n* Making block action execution dependent of the SecEngine status\n* Making block action execution dependent of the SecEngine status\n* Having body limits to respect the rule engine state\n* Fix SecRuleUpdateTargetById does not match regular expressions\n* Adds missing check for runtime ctl:ruleRemoveByTag\n* Adds a new operator verifySVNR that checks for Austrian social security numbers.\n* Fix variables output in debug logs\n* Correct typo validade in log output\n* fix/minor: Error encoding hexa decimal.\n* Limit more log variables to 200 characters.\n* parser: fix parsed file names\n* Allow empty anchored variable\n* Fixed FILES_NAMES collection after the end of multipart parsing\n* Fixed validateByteRange parsing method\n* Removes a memory leak on the JSON parser\n* Enables LMDB on the regression tests.\n* Fix: Extra whitespace in some configuration directives causing error\n* Refactoring on Regex and SMatch classes.\n* Fixed buffer overflow in Utils::Md5::hexdigest()\n* Implemented merge() method for ConfigInt, ConfigDouble, ConfigString\n* Adds initially support to the drop action.\n* Complete merging of particular rule properties\n* Replaces AC_CHECK_FILE with 'test -f'\n* Fix inet addr handling on 64 bit big endian systems\n* Fix tests on FreeBSD\n* Changes ENV test case to read the default MODSECURTIY env var\n* Regression: Sets MODSECURITY env var during the tests execution\n* Fix setenv action to strdup key=variable\n* Allow 0 length JSON requests.\n* Fix 'make dist' target to include default configuration\n* Replaced log locking using mutex with fcntl lock\n* Correct the usage of modsecurity::Phases::NUMBER_OF_PHASES\n* Adds support to multiple ranges in ctl:ruleRemoveById\n* Rule variable interpolation broken\n* Make the boundary check less strict as per RFC2046\n* Fix buffer size for utf8toUnicode transformation\n* Fix double macros bug\n* Override the default status code if not suitable to redirect action\n* parser: Fix the support for CRLF configuration files\n* Organizes the server logs\n* m_lineNumber in Rule not mapping with the correct line number in file\n* Using shared_ptr instead of unique_ptr on rules exceptions\n* Changes debuglogs schema to avoid unecessary str allocation\n* Fix the SecUnicodeMapFile and SecUnicodeCodePage\n* Changes the timing to save the rule message\n* Fix crash in msc_rules_add_file() when using disruptive action in chain\n* Fix memory leak in AuditLog::init()\n* Fix RulesProperties::appendRules()\n* Fix RULE lookup in chained rules\n* @ipMatch 'Could not add entry' on slash/32 notation in 2.9.0\n* Using values after transformation at MATCHED_VARS\n* Adds support to UpdateActionById.\n* Add correct C function prototypes for msc_init and msc_create_rule_set\n* Allow LuaJIT 2.1 to be used\n* Match m_id JSON log with RuleMessage and v2 format\n* Adds support to setenv action.\n* Adds new transaction constructor that accepts the transaction id as parameter.\n* Adds request IDs and URIs to the debug log\n* Treating variables exception on load-time instead of run time.\n* Fix: function m.setvar in Lua scripts and add testcases\n* Fix SecResponseBodyAccess and ctl:requestBodyAccess directives\n* Fix parser to support GeoLookup with MaxMind\n* parser: Fix simple quote setvar in the end of the line\n* modsec_rules_check: uses the gnu `.la' instead of `.a' file\n* good practices: Initialize variables before use it\n* Fix utf-8 character encoding conversion\n* Adds support for ctl:requestBodyProcessor=URLENCODED\n* Add LUA compatibility for CentOS and try to use LuaJIT first if available\n* Allow LuaJIT to be used\n* Implement support for Lua 5.1\n* Variable names must match fully, not partially. Match should be case insensitive.\n* Improves the performance while loading the rules\n* Allow empty strings to be evaluated by regex::searchAll\n* Adds basic pkg-config info\n* Fixed LMDB collection errors\n* Fixed false positive MULTIPART_UNMATCHED_BOUNDARY errors\n* Fix ip tree lookup on netmask content\n* Changes the behavior of the default sec actions\n* Refactoring on {global,ip,resources,session,tx,user} collections\n* Fix race condition in UniqueId::uniqueId()\n* Fix memory leak in error message for msc_rules_merge C APIs\n* Return false in SharedFiles::open() when an error happens\n* Use rvalue reference in ModSecurity::serverLog\n* Build System: Fix when multiple lines for curl version.\n* Checks if response body inspection is enabled before process it\n* Fix setvar parsing of quoted data\n* Adds time stamp back to the audit logs\n* Disables skip counter if debug log is disabled\n* Cosmetics: Represents amount of skipped rules without decimal\n* Add missing escapeSeqDecode, urlEncode and trimLeft/Right tfns to parser\n* Fix STATUS var parsing and accept STATUS_LINE var for v2 backward comp.\n* Fix memory leak in modsecurity::utils::expandEnv()\n* Initialize m_dtd member in ValidateDTD class as NULL\n* Fix broken @detectxss operator regression test case\n* Fix utils::string::ssplit() to handle delimiter in the end of string\n* Fix variable FILES_TMPNAMES \n* Fix memory leak in Collections\n* Fix lib version information while generating the .so file\n* Adds support for ctl:ruleRemoveByTag\n* Fix SecUploadDir configuration merge\n* Include all prerequisites for 'make check' into dist archive\n* Fix: Reverse logic of checking output in @inspectFile\n* Adds support to libMaxMind\n* Adds capture action to detectXSS\n* Temporarily accept invalid MULTIPART_SEMICOLON_MISSING operator\n* Adds capture action to detectSQLi\n* Adds capture action to rbl\n* Adds capture action to verifyCC\n* Adds capture action to verifySSN\n* Adds capture action to verifyCPF\n* Prettier error messages for unsupported configurations (UX)\n* Add missing verify*** transformation statements to parser\n* Fix a set of compilation warnings\n* Check for disruptive action on SecDefaultAction.\n* Fix block-block infinite loop.\n* Correction remove_by_tag and remove_by_msg logic.\n* Fix LMDB compile error\n* Fix msc_who_am_i() to return pointer to a valid C string\n* Added some cosmetics to autoconf related code\n* Fix 'make dist' target to include necessary headers for Lua\n* Fix 'include /foo/*.conf' for single matched object in directory\n* Add missing Base64 transformation statements to parser\n* Fixed resource load on ip match from file\n* Fixed examples compilation while using disable-shared\n* Fixed compilation issue while xml is disabled\n* Having LDADD and LDFLAGS organized on Makefile.am\n* Checking std::deque size before use it\n* perf improvement: Added the concept of RunTimeString and removed all run time parser.\n* perf improvement: Checks debuglog level before format debug msg\n* perf. improvement/rx: Only compute dynamic regex in case of macro\n* Fix uri on the benchmark utility\n* disable Lua on systems with liblua5.1\n","status":"published","published":"2023-09-25T22:01:56Z","modified":"2026-02-04T04:01:07.873209Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:12937-1","title":"libmodsecurity3-3.0.9-1.1 on GA media","description":"These are all security issues fixed in the libmodsecurity3-3.0.9-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:05:14.139693Z","updated_at":"2026-11-02T16:58:36.025801Z"}]}}