PT-2023-22029 · Trustwave · Modsecurity

Airween + 3 · Publicado 2023-04-28 · Atualizado 2025-07-03 · CVE-2023-28882

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Trustwave ModSecurity versions 3.0.5 through 3.0.8

Description The issue allows a denial of service, causing worker crash and unresponsiveness. This occurs because some inputs cause a segfault in the Transaction class for certain configurations.

Recommendations For Trustwave ModSecurity versions 3.0.5 through 3.0.8, update to version 3.0.9 to resolve the issue.

Correção

DoS

Allocation of Resources Without Limits

Resource Exhaustion

Enumeração de Fraquezas

CWE-770

CWE-400

Identificadores relacionados

ALT-PU-2023-6640

BIT-MODSECURITY-2023-28882

BIT-MODSECURITY2-2023-28882

CVE-2023-28882

OPENSUSE-SU-2023:0257-1

OPENSUSE-SU-2023:0269-1

OPENSUSE-SU-2024:12937-1

Produtos afetados

Modsecurity

Referências · 27

• https://trustwave.com/en-us/resources/security-resources/software-updates/announcing-modsecurity-version-309 · Nota
• https://suse.com/security/cve/CVE-2023-38285 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2023:0257-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-modsecurity2-2023-28882 · Aviso do Fabricante
• https://t.me/cvenotify/127673 · Publicação no Telegram
• https://lists.opensuse.org/archives/list/[e-mail]/thread/ILAHCTDLNZCBSVGSQN2ZDHVDHYE2OZ2N · Nota
• https://errata.altlinux.org/ALT-PU-2023-6640 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-38285 · Nota de Segurança
• https://lists.opensuse.org/archives/list/[e-mail]/thread/LIQVEGVX3JPH6JWIVOQVDUI4WMZNSIG4 · Nota
• https://t.me/cibsecurity/63023 · Publicação no Telegram
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-28882 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-28882 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-28882 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28882 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2023-28882 · Nota de Segurança