-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- ------------------------------------------------------------------------- Debian Security Advisory DSA-5023-1
security@debian.org https://www.debian.org/security/ Salvatore Bonaccorso December 18, 2021
https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : modsecurity-apache
CVE ID : CVE-2021-42717
It was discovered that modsecurity-apache, an Apache module to tighten
the Web application security, does not properly handles excessively
nested JSON objects, which could result in denial of service. The update introduces a new 'SecRequestBodyJsonDepthLimit' option to limit the
maximum request body JSON parsing depth which ModSecurity will accept
(defaults to 10000).
For the oldstable distribution (buster), this problem has been fixed
in version 2.9.3-1+deb10u1.
For the stable distribution (bullseye), this problem has been fixed in
version 2.9.3-3+deb11u1.
We recommend that you upgrade your modsecurity-apache packages.
For the detailed security status of modsecurity-apache please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/modsecurity-apache
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at:
https://www.debian.org/security/
Mailing list:
debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmG93fFfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0TISQ/9FDNX/GMbzanT4mYbAIXAbQ8tHGJhJVifHwnM8VcUv5xCecJDsHs5rg65 XSgAw7kyG17TotGrU+m8rhqbNrwcCnPAI5YqcxSKASim1Seu7Teayle+bDDTraHQ oTpNGaZ1aTaKtsQ3+TpHmsOoMcBivGX+ay7GldRO3krebAVAZEx8Y824tt/2jer5 XEM5XXkQA8fjRyr8K/JpdxivGCRL20KKg3dOLrUrw6UP8l/avd66ORGxCWRQ4abN RoCu2NkZul558kYa7q95DJy1Hwa0OHygq+wjeQnojJMsup/WD+YcRclbEJsEVG/s DEr3mYvekgtn0UlaRJWJNtknqUNHg67rts3wwlmXOLsLg1Darjm5HiowUMy8cki0 jvST+Zb5UdGO02Fj5xch/lP1VABpcra19+XGs1yNrAXhiE7FUZMCXlZqRgRKWx5O ueKIP7PAEp9TIaOA+H33y9y3EAWnM2l3BbstBV28d8rBecIHzRnkd4HQ2XgTh1Sd rM4a5KmADtWAdya4aRev1Qyr3qBEEU8q4A1TRMRLvBHosIETr6P0//+0dua97oE/ C8+sHm+CLo6scuD65Xpuyjv/zHPuxXSXN/Fkp6qgxhcH7MGwRbXx8JwsAWmGfWSL pjAcO7UMz0dLCR8hxpzsGLgjKQVC/STyh+ufHK5oEid41Z4PW60=
=9Flq
-----END PGP SIGNATURE-----
--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)