Описание
Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web Application Firewall when executing rules that read the FILES_TMP_CONTENT collection.
A vulnerability was found in ModSecurity. This issue occurs when FILES_TMP_CONTENT lacks complete content, which can lead to a Web Application Firewall bypass.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 7 | mod_security | Out of support scope | ||
| Red Hat Enterprise Linux 8 | mod_security | Will not fix | ||
| Red Hat Enterprise Linux 9 | mod_security | Will not fix | ||
| Red Hat Software Collections | httpd24-mod_security | Will not fix | ||
| JBoss Core Services for RHEL 8 | jbcs-httpd24-mod_security | Fixed | RHSA-2023:4629 | 15.08.2023 |
| JBoss Core Services on RHEL 7 | jbcs-httpd24-mod_security | Fixed | RHSA-2023:4629 | 15.08.2023 |
| Text-Only JBCS | mod_security | Fixed | RHSA-2023:4628 | 15.08.2023 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web Application Firewall when executing rules that read the FILES_TMP_CONTENT collection.
Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web Application Firewall when executing rules that read the FILES_TMP_CONTENT collection.
Incorrect handling of '\0' bytes in file uploads in ModSecurity before ...
EPSS
7.5 High
CVSS3