src:modsecurity-apache: CVE-2023-24021 In ModSecurity before 2.9.7, FILES_TMP_CONTENT sometimes lacked the complete content.

Debian Bug report logs - #1029329
src:modsecurity-apache: CVE-2023-24021 In ModSecurity before 2.9.7, FILES_TMP_CONTENT sometimes lacked the complete content.

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Tobias Frost <tobi@debian.org>

To: submit@bugs.debian.org

Cc: team@security.debian.org

Subject: src:modsecurity-apache: CVE-2023-24021 In ModSecurity before 2.9.7, FILES_TMP_CONTENT sometimes lacked the complete content.

Date: Sat, 21 Jan 2023 12:42:01 +0100

[Message part 1 (text/plain, inline)]

Source: modsecurity-apache
Severity: grave
Tags: upstream security fixed-upstream
Justification: user security hole
Forwarded: https://github.com/SpiderLabs/ModSecurity/pull/2857

(I'm filing this bug to have this issue documented and to have a bug to close in the changelog for the upcoming
ELTS/LTS uploads.)

CVE-2023-24021:
 In ModSecurity before 2.9.7, FILES_TMP_CONTENT sometimes lacked the complete content. This can lead to a Web Application Firewall bypass.


Note: I've received feedback (see the forwarded bug) that this bug potentially has huger impact (buffer overflow),
so possibly the CVE description will be updated, once Christian Folini has an updated description for me (thanks in advance!)

Cheers,
-- 
tobi

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.