git: 68cdd3bab9a0 - main - security/vuxml: Add mod_security DoS vulnerability

From: Fernando Apesteguía <fernape_at_FreeBSD.org>
Date: Fri, 30 May 2025 12:30:29 UTC
The branch main has been updated by fernape:

URL: https://cgit.FreeBSD.org/ports/commit/?id=68cdd3bab9a010c0f1c706c1e9e840ee0a2a0704

commit 68cdd3bab9a010c0f1c706c1e9e840ee0a2a0704
Author:     Fernando Apesteguía <fernape@FreeBSD.org>
AuthorDate: 2025-05-30 09:59:54 +0000
Commit:     Fernando Apesteguía <fernape@FreeBSD.org>
CommitDate: 2025-05-30 12:30:14 +0000

    security/vuxml: Add mod_security DoS vulnerability
    
     * CVE-2025-47947
    
    PR:     278180
---
 security/vuxml/vuln/2025.xml | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/security/vuxml/vuln/2025.xml b/security/vuxml/vuln/2025.xml
index 7675bb13d361..c8774e81ff1e 100644
--- a/security/vuxml/vuln/2025.xml
+++ b/security/vuxml/vuln/2025.xml
@@ -1,3 +1,36 @@
+  <vuln vid="a372abb0-3d3c-11f0-86e7-b42e991fc52e">
+    <topic>ModSecurity -- Possible DoS Vulnerability</topic>
+    <affects>
+      <package>
+	<name>ap24-mod_security</name>
+	<range><lt>2.9.8</lt></range>
+      </package>
+    </affects>
+    <description>
+	<body xmlns="http://www.w3.org/1999/xhtml">
+	<p>security-advisories@github.com reports:</p>
+	<blockquote cite="https://github.com/owasp-modsecurity/ModSecurity/pull/3389">
+	  <p>ModSecurity is an open source, cross platform web application
+	firewall (WAF) engine for Apache, IIS and Nginx.  Versions up to
+	and including 2.9.8 are vulnerable to denial of service in one
+	special case (in stable released versions): when the payload&apos;s
+	content type is `application/json`, and there is at least one rule
+	which does a `sanitiseMatchedBytes` action.  A patch is available
+	at pull request 3389 and expected to be part of version 2.9.9.  No
+	known workarounds are available.</p>
+	</blockquote>
+	</body>
+    </description>
+    <references>
+      <cvename>CVE-2025-47947</cvename>
+      <url>https://nvd.nist.gov/vuln/detail/CVE-2025-47947</url>
+    </references>
+    <dates>
+      <discovery>2025-05-21</discovery>
+      <entry>2025-05-30</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="67dd7a9e-3cd8-11f0-b601-5404a68ad561">
     <topic>traefik -- Path traversal vulnerability</topic>
     <affects>