OESA-2024-1377

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1377

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2024-1377.json

JSON Data

https://api.test.osv.dev/v1/vulns/OESA-2024-1377

Upstream

CVE-2022-48279

Published

2024-04-12T11:07:35Z

Modified

2025-08-12T05:37:32.915038Z

Summary

mod_security security update

Details

This software is also called Modsec,it is an open-source web application firewall. It is designed for Apache HTTP Server.ModSecurity is commonly deployed to provide protections against generic classed of vulnerabilities.The install of this package is easy and you can read the README.TXT for more information.

Security Fix(es):

In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall. NOTE: this is related to CVE-2022-39956 but can be considered independent changes to the ModSecurity (C language) codebase.(CVE-2022-48279)

Database specific

{
    "severity": "High"
}

References

Affected packages

openEuler:22.03-LTS / mod_security

Package

Name: mod_security
Purl: pkg:rpm/openEuler/mod_security&distro=openEuler-22.03-LTS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.9.5-3.oe2203

Ecosystem specific

{
    "aarch64": [
        "mod_security-2.9.5-3.oe2203.aarch64.rpm",
        "mod_security-debugsource-2.9.5-3.oe2203.aarch64.rpm",
        "mod_security-debuginfo-2.9.5-3.oe2203.aarch64.rpm"
    ],
    "x86_64": [
        "mod_security-2.9.5-3.oe2203.x86_64.rpm",
        "mod_security-debuginfo-2.9.5-3.oe2203.x86_64.rpm",
        "mod_security-debugsource-2.9.5-3.oe2203.x86_64.rpm"
    ],
    "src": [
        "mod_security-2.9.5-3.oe2203.src.rpm"
    ]
}