{"id":"openSUSE-SU-2023:0269-1","summary":"Security update for modsecurity","details":"This update for modsecurity fixes the following issues:\n\nUpdate to version 3.0.10:\n\n* Security impacting issue (fix boo#1213702, CVE-2023-38285)\n\n  - Fix: worst-case time in implementation of four transformations\n  - Additional information on this issue is available at \n    https://www.trustwave.com/resources/blogs/spiderlabs-blog/modsecurity-v3-dos-vulnerability-in-four-transformations-cve-2023-38285/\n\n* Enhancements and bug fixes\n\n  - Add TX synonym for MSC_PCRE_LIMITS_EXCEEDED\n  - Make MULTIPART_PART_HEADERS accessible to lua\n  - Fix: Lua scripts cannot read whole collection at once\n  - Fix: quoted Include config with wildcard\n  - Support isolated PCRE match limits\n  - Fix: meta actions not applied if multiMatch in first rule of chain\n  - Fix: audit log may omit tags when multiMatch\n  - Exclude CRLF from MULTIPART_PART_HEADER value\n  - Configure: use AS_ECHO_N instead echo -n\n  - Adjust position of memset from 2890\n\nUpdate to version 3.0.9:\n\n* Add some member variable inits in Transaction class (possible segfault)\n* Fix: possible segfault on reload if duplicate ip+CIDR in ip match list\n* Resolve memory leak on reload (bison-generated variable)\n* Support equals sign in XPath expressions\n* Encode two special chars in error.log output\n* Add JIT support for PCRE2\n* Support comments in ipMatchFromFile file via '#' token\n* Use name package name libmaxminddb with pkg-config\n* Fix: FILES_TMP_CONTENT collection key should use part name\n* Use AS_HELP_STRING instead of obsolete AC_HELP_STRING macro\n* During configure, do not check for pcre if pcre2 specified\n* Use pkg-config to find libxml2 first\n* Fix two rule-reload memory leak issues\n* Correct whitespace handling for Include directive\n- Fix CVE-2023-28882, a segfault and a resultant crash of a worker process\n  in some configurations with certain inputs, boo#1210993\n\nUpdate to version 3.0.8\n\n* Adjust parser activation rules in modsecurity.conf-recommended [#2796]\n* Multipart parsing fixes and new MULTIPART_PART_HEADERS collection [#2795]\n* Prevent LMDB related segfault [#2755, #2761]\n* Fix msc_transaction_cleanup function comment typo [#2788]\n* Fix: MULTIPART_INVALID_PART connected to wrong internal variable [#2785]\n* Restore Unique_id to include random portion after timestamp [#2752, #2758]\n\nUpdate to version 3.0.7\n\n* Support PCRE2\n* Support SecRequestBodyNoFilesLimit\n* Add ctl:auditEngine action support\n* Move PCRE2 match block from member variable\n* Add SecArgumentsLimit, 200007 to modsecurity.conf-recommended\n* Fix memory leak when concurrent log includes REMOTE_USER\n* Fix LMDB initialization issues\n* Fix initcol error message wording\n* Tolerate other parameters after boundary in multipart C-T\n* Add DebugLog message for bad pattern in rx operator\n* Fix misuses of LMDB API\n* Fix duplication typo in code comment\n* Fix multiMatch msg, etc, population in audit log\n* Fix some name handling for ARGS_*NAMES: regex SecRuleUpdateTargetById, etc.\n* Adjust confusing variable name in setRequestBody method\n* Multipart names/filenames may include single quote if double-quote enclosed\n* Add SecRequestBodyJsonDepthLimit to modsecurity.conf-recommended\n\nUpdate to version 3.0.6\n\n* Security issue: Support configurable limit on depth of JSON\n  parsing, possible DoS issue. CVE-2021-42717\n\nUpdate to version 3.0.5\n\n* New: Having ARGS_NAMES, variables proxied\n* Fix: FILES variable does not use multipart part name for key\n* GeoIP: switch to GEOIP_MEMORY_CACHE from GEOIP_INDEX_CACHE\n* Support configurable limit on number of arguments processed\n* Adds support to lua 5.4\n* Add support for new operator rxGlobal\n* Fix: Replaces put with setenv in SetEnv action\n* Fix: Regex key selection should not be case-sensitive\n* Fix: Only delete Multipart tmp files after rules have run\n* Fixed MatchedVar on chained rules\n* Fix IP address logging in Section A\n* Fix:  rx: exit after full match (remove /g emulation); ensure\n  capture groups occuring after unused groups still populate TX vars\n* Fix rule-update-target for non-regex\n* Fix Security Impacting Issues:\n* Handle URI received with uri-fragment, CVE-2020-15598\n\nUpdate to version 3.0.4:\n\n* Fix: audit log data omitted when nolog,auditlog\n* Fix: ModSecurity 3.x inspectFile operator does not pass\n* XML: Remove error messages from stderr\n* Filter comment or blank line for pmFromFile operator\n* Additional adjustment to Cookie header parsing\n* Restore chained rule part H logging to be more like 2.9 behaviour\n* Small fixes in log messages to help debugging the file upload\n* Fix Cookie header parsing issues\n* Fix rules with nolog are logging to part H\n* Fix argument key-value pair parsing cases\n* Fix: audit log part for response body for JSON format to be E\n* Make sure m_rulesMessages is filled after successfull match\n* Fix @pm lookup for possible matches on offset zero.\n* Regex lookup on the key name instead of COLLECTION:key\n* Missing throw in Operator::instantiate\n* Making block action execution dependent of the SecEngine status\n* Making block action execution dependent of the SecEngine status\n* Having body limits to respect the rule engine state\n* Fix SecRuleUpdateTargetById does not match regular expressions\n* Adds missing check for runtime ctl:ruleRemoveByTag\n* Adds a new operator verifySVNR that checks for Austrian social security numbers.\n* Fix variables output in debug logs\n* Correct typo validade in log output\n* fix/minor: Error encoding hexa decimal.\n* Limit more log variables to 200 characters.\n* parser: fix parsed file names\n* Allow empty anchored variable\n* Fixed FILES_NAMES collection after the end of multipart parsing\n* Fixed validateByteRange parsing method\n* Removes a memory leak on the JSON parser\n* Enables LMDB on the regression tests.\n* Fix: Extra whitespace in some configuration directives causing error\n* Refactoring on Regex and SMatch classes.\n* Fixed buffer overflow in Utils::Md5::hexdigest()\n* Implemented merge() method for ConfigInt, ConfigDouble, ConfigString\n* Adds initially support to the drop action.\n* Complete merging of particular rule properties\n* Replaces AC_CHECK_FILE with 'test -f'\n* Fix inet addr handling on 64 bit big endian systems\n* Fix tests on FreeBSD\n* Changes ENV test case to read the default MODSECURTIY env var\n* Regression: Sets MODSECURITY env var during the tests execution\n* Fix setenv action to strdup key=variable\n* Allow 0 length JSON requests.\n* Fix 'make dist' target to include default configuration\n* Replaced log locking using mutex with fcntl lock\n* Correct the usage of modsecurity::Phases::NUMBER_OF_PHASES\n* Adds support to multiple ranges in ctl:ruleRemoveById\n* Rule variable interpolation broken\n* Make the boundary check less strict as per RFC2046\n* Fix buffer size for utf8toUnicode transformation\n* Fix double macros bug\n* Override the default status code if not suitable to redirect action\n* parser: Fix the support for CRLF configuration files\n* Organizes the server logs\n* m_lineNumber in Rule not mapping with the correct line number in file\n* Using shared_ptr instead of unique_ptr on rules exceptions\n* Changes debuglogs schema to avoid unecessary str allocation\n* Fix the SecUnicodeMapFile and SecUnicodeCodePage\n* Changes the timing to save the rule message\n* Fix crash in msc_rules_add_file() when using disruptive action in chain\n* Fix memory leak in AuditLog::init()\n* Fix RulesProperties::appendRules()\n* Fix RULE lookup in chained rules\n* @ipMatch 'Could not add entry' on slash/32 notation in 2.9.0\n* Using values after transformation at MATCHED_VARS\n* Adds support to UpdateActionById.\n* Add correct C function prototypes for msc_init and msc_create_rule_set\n* Allow LuaJIT 2.1 to be used\n* Match m_id JSON log with RuleMessage and v2 format\n* Adds support to setenv action.\n* Adds new transaction constructor that accepts the transaction id as parameter.\n* Adds request IDs and URIs to the debug log\n* Treating variables exception on load-time instead of run time.\n* Fix: function m.setvar in Lua scripts and add testcases\n* Fix SecResponseBodyAccess and ctl:requestBodyAccess directives\n* Fix parser to support GeoLookup with MaxMind\n* parser: Fix simple quote setvar in the end of the line\n* modsec_rules_check: uses the gnu `.la' instead of `.a' file\n* good practices: Initialize variables before use it\n* Fix utf-8 character encoding conversion\n* Adds support for ctl:requestBodyProcessor=URLENCODED\n* Add LUA compatibility for CentOS and try to use LuaJIT first if available\n* Allow LuaJIT to be used\n* Implement support for Lua 5.1\n* Variable names must match fully, not partially. Match should be case insensitive.\n* Improves the performance while loading the rules\n* Allow empty strings to be evaluated by regex::searchAll\n* Adds basic pkg-config info\n* Fixed LMDB collection errors\n* Fixed false positive MULTIPART_UNMATCHED_BOUNDARY errors\n* Fix ip tree lookup on netmask content\n* Changes the behavior of the default sec actions\n* Refactoring on {global,ip,resources,session,tx,user} collections\n* Fix race condition in UniqueId::uniqueId()\n* Fix memory leak in error message for msc_rules_merge C APIs\n* Return false in SharedFiles::open() when an error happens\n* Use rvalue reference in ModSecurity::serverLog\n* Build System: Fix when multiple lines for curl version.\n* Checks if response body inspection is enabled before process it\n* Fix setvar parsing of quoted data\n* Adds time stamp back to the audit logs\n* Disables skip counter if debug log is disabled\n* Cosmetics: Represents amount of skipped rules without decimal\n* Add missing escapeSeqDecode, urlEncode and trimLeft/Right tfns to parser\n* Fix STATUS var parsing and accept STATUS_LINE var for v2 backward comp.\n* Fix memory leak in modsecurity::utils::expandEnv()\n* Initialize m_dtd member in ValidateDTD class as NULL\n* Fix broken @detectxss operator regression test case\n* Fix utils::string::ssplit() to handle delimiter in the end of string\n* Fix variable FILES_TMPNAMES \n* Fix memory leak in Collections\n* Fix lib version information while generating the .so file\n* Adds support for ctl:ruleRemoveByTag\n* Fix SecUploadDir configuration merge\n* Include all prerequisites for 'make check' into dist archive\n* Fix: Reverse logic of checking output in @inspectFile\n* Adds support to libMaxMind\n* Adds capture action to detectXSS\n* Temporarily accept invalid MULTIPART_SEMICOLON_MISSING operator\n* Adds capture action to detectSQLi\n* Adds capture action to rbl\n* Adds capture action to verifyCC\n* Adds capture action to verifySSN\n* Adds capture action to verifyCPF\n* Prettier error messages for unsupported configurations (UX)\n* Add missing verify*** transformation statements to parser\n* Fix a set of compilation warnings\n* Check for disruptive action on SecDefaultAction.\n* Fix block-block infinite loop.\n* Correction remove_by_tag and remove_by_msg logic.\n* Fix LMDB compile error\n* Fix msc_who_am_i() to return pointer to a valid C string\n* Added some cosmetics to autoconf related code\n* Fix 'make dist' target to include necessary headers for Lua\n* Fix 'include /foo/*.conf' for single matched object in directory\n* Add missing Base64 transformation statements to parser\n* Fixed resource load on ip match from file\n* Fixed examples compilation while using disable-shared\n* Fixed compilation issue while xml is disabled\n* Having LDADD and LDFLAGS organized on Makefile.am\n* Checking std::deque size before use it\n* perf improvement: Added the concept of RunTimeString and removed all run time parser.\n* perf improvement: Checks debuglog level before format debug msg\n* perf. improvement/rx: Only compute dynamic regex in case of macro\n* Fix uri on the benchmark utility\n* disable Lua on systems with liblua5.1\n","modified":"2026-02-04T04:01:07.873209Z","published":"2023-09-25T22:01:56Z","related":["CVE-2020-15598","CVE-2021-42717","CVE-2023-28882","CVE-2023-38285"],"upstream":["CVE-2020-15598","CVE-2021-42717","CVE-2023-28882","CVE-2023-38285"],"references":[{"type":"ADVISORY","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ILAHCTDLNZCBSVGSQN2ZDHVDHYE2OZ2N/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1210993"},{"type":"REPORT","url":"https://bugzilla.suse.com/1213702"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2020-15598"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2021-42717"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-28882"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-38285"}],"affected":[{"package":{"name":"modsecurity","ecosystem":"SUSE:Package Hub 15 SP4","purl":"pkg:rpm/suse/modsecurity&distro=SUSE%20Package%20Hub%2015%20SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.10-bp154.2.3.1"}]}],"ecosystem_specific":{"binaries":[{"libmodsecurity3-32bit":"3.0.10-bp154.2.3.1","libmodsecurity3-64bit":"3.0.10-bp154.2.3.1","libmodsecurity3":"3.0.10-bp154.2.3.1","modsecurity-devel":"3.0.10-bp154.2.3.1","modsecurity":"3.0.10-bp154.2.3.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2023:0269-1.json"}},{"package":{"name":"modsecurity","ecosystem":"openSUSE:Leap 15.4","purl":"pkg:rpm/opensuse/modsecurity&distro=openSUSE%20Leap%2015.4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.10-bp154.2.3.1"}]}],"ecosystem_specific":{"binaries":[{"libmodsecurity3-32bit":"3.0.10-bp154.2.3.1","libmodsecurity3-64bit":"3.0.10-bp154.2.3.1","libmodsecurity3":"3.0.10-bp154.2.3.1","modsecurity-devel":"3.0.10-bp154.2.3.1","modsecurity":"3.0.10-bp154.2.3.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2023:0269-1.json"}}],"schema_version":"1.7.3"}