Security Update for modsecurity-apache
Summary
DSA-2991-1: modsecurity-apache - security update. Affects modsecurity-apache versions < 2.6.6-6+deb7u2. Fixed in 2.6.6-6+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
modsecurity-apache is an Apache module designed to enhance web application security. It provides additional security features and helps enforce security policies for web applications running on Apache servers. This module is vulnerable to a flaw that allows remote attackers to bypass intended mod_security restrictions.
Vulnerability Detail
The vulnerability in modsecurity-apache allows remote attackers to bypass security restrictions by using chunked transfer coding with a capitalized Chunked value in the Transfer-Encoding HTTP header. This allows the attacker to send requests containing content that should have been removed by mod_security. The flaw was discovered by Martin Holst Swende and can potentially lead to unauthorized access or other security breaches.
How To Fix
Minimum fixed version
2.6.6-6+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade modsecurity-apacheTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
It is crucial to upgrade the modsecurity-apache package to the recommended version or later to mitigate the risk of unauthorized access and other security breaches. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for modsecurity-apache →
FAQ
modsecurity-apache is an Apache module that enhances web application security by providing additional security features and enforcing security policies.
The vulnerability allows remote attackers to bypass mod_security restrictions, potentially leading to unauthorized access or other security breaches.
To fix this vulnerability, upgrade the modsecurity-apache package to version 2.6.6-6+deb7u2 or later.
No specific workaround has been mentioned for this vulnerability.
The vulnerability was discovered by Martin Holst Swende.
Related vulnerabilities
Recent vulnerabilities recorded for modsecurity-apache.
