CVE-2023-24021
Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on...
Original description
The description as published by the source.
Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over-reads on the Web Application Firewall when executing rules that read the FILES_TMP_CONTENT collection.
Affected packages
Bitnami
modsecurity2
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.9.7"}]}]
Bitnami
modsecurity
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.9.7"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2023-24021 modsecurity-apache Fixed in: 2.9.3-3+deb11u2
References
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory lists.fedoraproject.org
- advisory nvd.nist.gov
- advisory github.com
- patch github.com
- web github.com
- web github.com
- web lists.debian.org