From 288d63bfcded7c2256217c3cfda57e792b0e46ac Mon Sep 17 00:00:00 2001 From: Thomas Perale Date: Mon, 30 Jun 2025 09:24:23 +0200 Subject: [PATCH] package/modsecurity2: security bump to v2.9.10 Fixes the following security issues: - CVE 2025-47947: Versions up to and including 2.9.8 are vulnerable to denial of service in one special case (in stable released versions): when the payload's content type is application/json, and there is at least one rule which does a sanitiseMatchedBytes action. A patch is available at pull request 3389 and expected to be part of version 2.9.9. No known workarounds are available. For more information, see: - https://nvd.nist.gov/vuln/detail/CVE-2025-47947 - https://github.com/owasp-modsecurity/ModSecurity/pull/3389 - CVE-2025-48866: Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The `sanitiseArg` (and `sanitizeArg` - this is the same action but an alias) is vulnerable to adding an excessive number of arguments, thereby leading to denial of service. Version 2.9.10 fixes the issue. As a workaround, avoid using rules that contain the `sanitiseArg` (or `sanitizeArg`) action. For more information, see: - https://nvd.nist.gov/vuln/detail/CVE-2025-48866 - https://github.com/owasp-modsecurity/ModSecurity/commit/3a54ccea62d3f7151bb08cb78d60c5e90b53ca2e For more details on the version bump, see: - https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.8 - https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.9 - https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.10 Also this patch change the _SOURCE variable that now include a 'v' prefixing the version. Signed-off-by: Thomas Perale [Julien: update hash source url in hash file comment] Signed-off-by: Julien Olivain (cherry picked from commit 3d593a8144ad8890dae4ab6fd235eef700d3c144) Signed-off-by: Thomas Perale --- package/modsecurity2/modsecurity2.hash | 4 ++-- package/modsecurity2/modsecurity2.mk | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package/modsecurity2/modsecurity2.hash b/package/modsecurity2/modsecurity2.hash index fbb7fabb3a..186e13d766 100644 --- a/package/modsecurity2/modsecurity2.hash +++ b/package/modsecurity2/modsecurity2.hash @@ -1,5 +1,5 @@ -# From https://github.com/owasp-modsecurity/ModSecurity/releases/download/v2.9.7/modsecurity-2.9.7.tar.gz.sha256 -sha256 2a28fcfccfef21581486f98d8d5fe0397499749b8380f60ec7bb1c08478e1839 modsecurity-2.9.7.tar.gz +# From https://github.com/owasp-modsecurity/ModSecurity/releases/download/v2.9.10/modsecurity-v2.9.10.tar.gz.sha256 +sha256 081cda52975494139922fa4b54f474fed8a6db4b7f586cb0d3aeec635f7a4d53 modsecurity-v2.9.10.tar.gz # Locally computed sha256 2c564f5a67e49e74c80e5a7dcacd1904e7408f1fd6a95218b38c04f012d94cb9 LICENSE diff --git a/package/modsecurity2/modsecurity2.mk b/package/modsecurity2/modsecurity2.mk index 36d6e1a847..b644fe7407 100644 --- a/package/modsecurity2/modsecurity2.mk +++ b/package/modsecurity2/modsecurity2.mk @@ -4,8 +4,8 @@ # ################################################################################ -MODSECURITY2_VERSION = 2.9.7 -MODSECURITY2_SOURCE = modsecurity-$(MODSECURITY2_VERSION).tar.gz +MODSECURITY2_VERSION = 2.9.10 +MODSECURITY2_SOURCE = modsecurity-v$(MODSECURITY2_VERSION).tar.gz MODSECURITY2_SITE = https://github.com/owasp-modsecurity/ModSecurity/releases/download/v$(MODSECURITY2_VERSION) MODSECURITY2_LICENSE = Apache-2.0 MODSECURITY2_LICENSE_FILES = LICENSE