Libmodsecurity3 has possible bypass of encoded HTML entities
Résumé
Libmodsecurity3 has possible bypass of encoded HTML entities
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Libmodsecurity is one component of the ModSecurity v3 project. The library codebase serves as an interface to ModSecurity Connectors taking in web traffic and applying traditional ModSecurity processing. A bug that exists only in Libmodsecurity3 version 3.0.13 means that, in 3.0.13, Libmodsecurity3 can't decode encoded HTML entities if they contains leading zeroes. Version 3.0.14 contains a fix. No known workarounds are available.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2025-27110 modsecurity Corrigé dans: 3.0.14-1
- Ubuntu UBUNTU-CVE-2025-27110 modsecurity
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- report github.com