🛡️ openSUSE-SU-2023:0269-1 — modsecurity (CVE-2023-38285 +3 more)

Security update for modsecurity

This update for modsecurity fixes the following issues:

Update to version 3.0.10:

• Security impacting issue (fix boo#1213702, CVE-2023-38285)
• Fix: worst-case time in implementation of four transformations
• Additional information on this issue is available at

https://www.trustwave.com/resources/blogs/spiderlabs-blog/modsecurity-v3-dos-vulnerability-in-four-transformations-cve-2023-38285/

• Enhancements and bug fixes
• Add TX synonym for MSC_PCRE_LIMITS_EXCEEDED
• Make MULTIPART_PART_HEADERS accessible to lua
• Fix: Lua scripts cannot read whole collection at once
• Fix: quoted Include config with wildcard
• Support isolated PCRE match limits
• Fix: meta actions not applied if multiMatch in first rule of chain
• Fix: audit log may omit tags when multiMatch
• Exclude CRLF from MULTIPART_PART_HEADER value
• Configure: use AS_ECHO_N instead echo -n
• Adjust position of memset from 2890

Update to version 3.0.9:

• Add some member variable inits in Transaction class (possible segfault)
• Fix: possible segfault on reload if duplicate ip+CIDR in ip match list
• Resolve memory leak on reload (bison-generated variable)
• Support equals sign in XPath expressions
• Encode two special chars in error.log output
• Add JIT support for PCRE2
• Support comments in ipMatchFromFile file via '#' token
• Use name package name libmaxminddb with pkg-config
• Fix: FILES_TMP_CONTENT collection key should use part name
• Use AS_HELP_STRING instead of obsolete AC_HELP_STRING macro
• During configure, do not check for pcre if pcre2 specified
• Use pkg-config to find libxml2 first
• Fix two rule-reload memory leak issues
• Correct whitespace handling for Include directive
• Fix CVE-2023-28882, a segfault and a resultant crash of a worker process

in some configurations with certain inputs, boo#1210993

Update to version 3.0.8

• Adjust parser activation rules in modsecurity.conf-recommended [#2796]
• Multipart parsing fixes and new MULTIPART_PART_HEADERS collection [#2795]
• Prevent LMDB related segfault [#2755, #2761]
• Fix msc_transaction_cleanup function comment typo [#2788]
• Fix: MULTIPART_INVALID_PART connected to wrong internal variable [#2785]
• Restore Unique_id to include random portion after timestamp [#2752, #2758]

Update to version 3.0.7

• Support PCRE2
• Support SecRequestBodyNoFilesLimit
• Add ctl:auditEngine action support
• Move PCRE2 match block from member variable
• Add SecArgumentsLimit, 200007 to modsecurity.conf-recommended
• Fix memory leak when concurrent log includes REMOTE_USER
• Fix LMDB initialization issues
• Fix initcol error message wording
• Tolerate other parameters after boundary in multipart C-T
• Add DebugLog message for bad pattern in rx operator
• Fix misuses of LMDB API
• Fix duplication typo in code comment
• Fix multiMatch msg, etc, population in audit log
• Fix some name handling for ARGS_*NAMES: regex SecRuleUpdateTargetById, etc.
• Adjust confusing variable name in setRequestBody method
• Multipart names/filenames may include single quote if double-quote enclosed
• Add SecRequestBodyJsonDepthLimit to modsecurity.conf-recommended

Update to version 3.0.6

• Security issue: Support configurable limit on depth of JSON

parsing, possible DoS issue. CVE-2021-42717

Update to version 3.0.5

• New: Having ARGS_NAMES, variables proxied
• Fix: FILES variable does not use multipart part name for key
• GeoIP: switch to GEOIP_MEMORY_CACHE from GEOIP_INDEX_CACHE
• Support configurable limit on number of arguments processed
• Adds support to lua 5.4
• Add support for new operator rxGlobal
• Fix: Replaces put with setenv in SetEnv action
• Fix: Regex key selection should not be case-sensitive
• Fix: Only delete Multipart tmp files after rules have run
• Fixed MatchedVar on chained rules
• Fix IP address logging in Section A
• Fix: rx: exit after full match (remove /g emulation); ensure

capture groups occuring after unused groups still populate TX vars

• Fix rule-update-target for non-regex
• Fix Security Impacting Issues:
• Handle URI received with uri-fragment, CVE-2020-15598

Update to version 3.0.4:

• Fix: audit log data omitted when nolog,auditlog
• Fix: ModSecurity 3.x inspectFile operator does not pass
• XML: Remove error messages from stderr
• Filter comment or blank line for pmFromFile operator
• Additional adjustment to Cookie header parsing
• Restore chained rule part H logging to be more like 2.9 behaviour
• Small fixes in log messages to help debugging the file upload
• Fix Cookie header parsing issues
• Fix rules with nolog are logging to part H
• Fix argument key-value pair parsing cases
• Fix: audit log part for response body for JSON format to be E
• Make sure m_rulesMessages is filled after successfull match
• Fix @pm lookup for possible matches on offset zero.
• Regex lookup on the key name instead of COLLECTION:key
• Missing throw in Operator::instantiate
• Making block action execution dependent of the SecEngi