git: 68cdd3bab9a0 - main - security/vuxml: Add mod_security DoS vulnerability
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Fri, 30 May 2025 12:30:29 UTC
The branch main has been updated by fernape:
URL: https://cgit.FreeBSD.org/ports/commit/?id=68cdd3bab9a010c0f1c706c1e9e840ee0a2a0704
commit 68cdd3bab9a010c0f1c706c1e9e840ee0a2a0704
Author: Fernando Apesteguía <fernape@FreeBSD.org>
AuthorDate: 2025-05-30 09:59:54 +0000
Commit: Fernando Apesteguía <fernape@FreeBSD.org>
CommitDate: 2025-05-30 12:30:14 +0000
security/vuxml: Add mod_security DoS vulnerability
* CVE-2025-47947
PR: 278180
---
security/vuxml/vuln/2025.xml | 33 +++++++++++++++++++++++++++++++++
1 file changed, 33 insertions(+)
diff --git a/security/vuxml/vuln/2025.xml b/security/vuxml/vuln/2025.xml
index 7675bb13d361..c8774e81ff1e 100644
--- a/security/vuxml/vuln/2025.xml
+++ b/security/vuxml/vuln/2025.xml
@@ -1,3 +1,36 @@
+ <vuln vid="a372abb0-3d3c-11f0-86e7-b42e991fc52e">
+ <topic>ModSecurity -- Possible DoS Vulnerability</topic>
+ <affects>
+ <package>
+ <name>ap24-mod_security</name>
+ <range><lt>2.9.8</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>security-advisories@github.com reports:</p>
+ <blockquote cite="https://github.com/owasp-modsecurity/ModSecurity/pull/3389">
+ <p>ModSecurity is an open source, cross platform web application
+ firewall (WAF) engine for Apache, IIS and Nginx. Versions up to
+ and including 2.9.8 are vulnerable to denial of service in one
+ special case (in stable released versions): when the payload's
+ content type is `application/json`, and there is at least one rule
+ which does a `sanitiseMatchedBytes` action. A patch is available
+ at pull request 3389 and expected to be part of version 2.9.9. No
+ known workarounds are available.</p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2025-47947</cvename>
+ <url>https://nvd.nist.gov/vuln/detail/CVE-2025-47947</url>
+ </references>
+ <dates>
+ <discovery>2025-05-21</discovery>
+ <entry>2025-05-30</entry>
+ </dates>
+ </vuln>
+
<vuln vid="67dd7a9e-3cd8-11f0-b601-5404a68ad561">
<topic>traefik -- Path traversal vulnerability</topic>
<affects>