PT-2021-4072 · Unknown · Modsecurity

Published 2021-05-06 · Updated 2025-07-03 · CVE-2019-25043

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions ModSecurity versions 3.x before 3.0.4 ModSecurity version 3.0.4 is not affected, so the range can be simplified to versions prior to 3.0.4.

Description The issue is related to incorrect parsing of key-value pairs, which can lead to a "string index out of range" error and cause a worker-process crash. This can be triggered by a "Cookie: =abc" header. The vulnerability can be exploited by a remote attacker to cause a denial of service.

Recommendations For versions prior to 3.0.4, update to version 3.0.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the Cookie header to minimize the risk of exploitation.

Exploit

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

BDU:2021-04618

CVE-2019-25043

Affected Products

Modsecurity

References · 12

• 🔥 https://github.com/SpiderLabs/ModSecurity/issues/2566 · Exploit
• https://cve.org/CVERecord?id=CVE-2019-25043 · Security Note
• https://ubuntu.com/security/CVE-2019-25043 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-25043 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-25043 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-25043 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04618 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-25043 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-25043 · Vendor Advisory
• https://github.com/SpiderLabs/ModSecurity/commit/9cac167fafd180902c2aa5dc6141aae874127199 · Note
• https://t.me/cvenotify/127670 · Telegram Post
• https://t.me/cvenotify/14460 · Telegram Post