Source: modsecurity-apache Severity: grave Tags: upstream security fixed-upstream Justification: user security hole Forwarded: https://github.com/SpiderLabs/ModSecurity/pull/2857
(I'm filing this bug to have this issue documented and to have a bug to close in the changelog for the upcoming ELTS/LTS uploads.) CVE-2023-24021: In ModSecurity before 2.9.7, FILES_TMP_CONTENT sometimes lacked the complete content. This can lead to a Web Application Firewall bypass. Note: I've received feedback (see the forwarded bug) that this bug potentially has huger impact (buffer overflow), so possibly the CVE description will be updated, once Christian Folini has an updated description for me (thanks in advance!) Cheers, -- tobi
signature.asc
Description: PGP signature
