Libmodsecurity3 has possible bypass of encoded HTML entities
概要
Libmodsecurity3 has possible bypass of encoded HTML entities
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Libmodsecurity is one component of the ModSecurity v3 project. The library codebase serves as an interface to ModSecurity Connectors taking in web traffic and applying traditional ModSecurity processing. A bug that exists only in Libmodsecurity3 version 3.0.13 means that, in 3.0.13, Libmodsecurity3 can't decode encoded HTML entities if they contains leading zeroes. Version 3.0.14 contains a fix. No known workarounds are available.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2025-27110 modsecurity 修正版: 3.0.14-1
- Ubuntu UBUNTU-CVE-2025-27110 modsecurity
参照URL
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- report github.com