Alerts This Week
Warning Icon 1 916
Alerts This Week
Warning Icon 1 916

openSUSE 2023:0269-1 Moderate: Modsecurity DoS Exploit Mitigation

opensuse
Calendar Grey September 26, 2023
Dist Opensuse Esm H88
Stay secure with the latest OWASP Core Rule Set updates to combat vulnerabilities. Optimize ModSecurity performance on openSUSE while monitoring logs with tools like Fail2Ban
An update that fixes four vulnerabilities is now available

Description

This update for modsecurity fixes the following issues:

Update to version 3.0.10:

* Security impacting issue (fix boo#1213702, CVE-2023-38285)

- Fix: worst-case time in implementation of four transformations

- Additional information on this issue is available at

s-vulnerability-in-four-transformations-cve-2023-38285/

* Enhancements and bug fixes

- Add TX synonym for MSC_PCRE_LIMITS_EXCEEDED

- Make MULTIPART_PART_HEADERS accessible to lua

- Fix: Lua scripts cannot read whole collection at once

- Fix: quoted Include config with wildcard

- Support isolated PCRE match limits

- Fix: meta actions not applied if multiMatch in first rule of chain

- Fix: audit log may omit tags when multiMatch

- Exclude CRLF from MULTIPART_PART_HEADER value

- Configure: use AS_ECHO_N instead echo -n

- Adjust position of memset from 2890

Update to version 3.0.9:

* Add some member variable inits in Transaction class...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory software update system stability Denial of Service modsecurity openSUSE patch instructions

Patch

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods

like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Backports SLE-15-SP4:

zypper in -t patch openSUSE-2023-269=1

Package List

- openSUSE Backports SLE-15-SP4 (aarch64 i586 ppc64le s390x x86_64):

libmodsecurity3-3.0.10-bp154.2.3.1

modsecurity-3.0.10-bp154.2.3.1

modsecurity-devel-3.0.10-bp154.2.3.1

- openSUSE Backports SLE-15-SP4 (aarch64_ilp32):

libmodsecurity3-64bit-3.0.10-bp154.2.3.1

- openSUSE Backports SLE-15-SP4 (x86_64):

libmodsecurity3-32bit-3.0.10-bp154.2.3.1

References

https://www.suse.com/security/cve/CVE-2020-15598.html

https://www.suse.com/security/cve/CVE-2021-42717.html

https://www.suse.com/security/cve/CVE-2023-28882.html

https://www.suse.com/security/cve/CVE-2023-38285.html

https://bugzilla.suse.com/1210993

https://bugzilla.suse.com/1213702

Announcement ID: openSUSE-SU-2023:0269-1
Rating: moderate
Affected Products: openSUSE Backports SLE-15-SP4 .

Topics%20covered

Topics Covered

security advisory software update system stability Denial of Service modsecurity openSUSE patch instructions

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here