1. Forum
  2. Usenet
  3. LINUX.DEBIAN.ANNOUNCE.SEC

  • [SECURITY] [DSA 5023-1] modsecurity-apache security update

    From Salvatore Bonaccorso@21:1/5 to All on Sat Dec 18 14:20:02 2021
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA512

    - ------------------------------------------------------------------------- Debian Security Advisory DSA-5023-1 security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso December 18, 2021 https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package : modsecurity-apache
    CVE ID : CVE-2021-42717

    It was discovered that modsecurity-apache, an Apache module to tighten
    the Web application security, does not properly handles excessively
    nested JSON objects, which could result in denial of service. The update introduces a new 'SecRequestBodyJsonDepthLimit' option to limit the
    maximum request body JSON parsing depth which ModSecurity will accept
    (defaults to 10000).

    For the oldstable distribution (buster), this problem has been fixed
    in version 2.9.3-1+deb10u1.

    For the stable distribution (bullseye), this problem has been fixed in
    version 2.9.3-3+deb11u1.

    We recommend that you upgrade your modsecurity-apache packages.

    For the detailed security status of modsecurity-apache please refer to
    its security tracker page at: https://security-tracker.debian.org/tracker/modsecurity-apache

    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org
    -----BEGIN PGP SIGNATURE-----

    iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmG93fFfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0TISQ/9FDNX/GMbzanT4mYbAIXAbQ8tHGJhJVifHwnM8VcUv5xCecJDsHs5rg65 XSgAw7kyG17TotGrU+m8rhqbNrwcCnPAI5YqcxSKASim1Seu7Teayle+bDDTraHQ oTpNGaZ1aTaKtsQ3+TpHmsOoMcBivGX+ay7GldRO3krebAVAZEx8Y824tt/2jer5 XEM5XXkQA8fjRyr8K/JpdxivGCRL20KKg3dOLrUrw6UP8l/avd66ORGxCWRQ4abN RoCu2NkZul558kYa7q95DJy1Hwa0OHygq+wjeQnojJMsup/WD+YcRclbEJsEVG/s DEr3mYvekgtn0UlaRJWJNtknqUNHg67rts3wwlmXOLsLg1Darjm5HiowUMy8cki0 jvST+Zb5UdGO02Fj5xch/lP1VABpcra19+XGs1yNrAXhiE7FUZMCXlZqRgRKWx5O ueKIP7PAEp9TIaOA+H33y9y3EAWnM2l3BbstBV28d8rBecIHzRnkd4HQ2XgTh1Sd rM4a5KmADtWAdya4aRev1Qyr3qBEEU8q4A1TRMRLvBHosIETr6P0//+0dua97oE/ C8+sHm+CLo6scuD65Xpuyjv/zHPuxXSXN/Fkp6qgxhcH7MGwRbXx8JwsAWmGfWSL pjAcO7UMz0dLCR8hxpzsGLgjKQVC/STyh+ufHK5oEid41Z4PW60=
    =9Flq
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)