Test ID:	1.3.6.1.4.1.25623.1.0.893293
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DLA-3293-1)
Summary:	The remote host is missing an update for the Debian 'modsecurity-crs' package(s) announced via the DLA-3293-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'modsecurity-crs' package(s) announced via the DLA-3293-1 advisory. Vulnerability Insight: Multiple issues were found in modsecurity-crs, a set of generic attack detection rules for use with ModSecurity or compatible web application firewalls, which allows remote attackers to bypass the web applications firewall. If you are using modsecurity-crs with apache2 / libapache2-modsecurity, please make sure to review your modsecurity configuration, usually /etc/modsecurity/modsecurity.conf, against the updated recommended configuration, available in /etc/modsecurity/modsecurity.conf-recommended: Some of the changes to the recommended rules are required to avoid WAF bypasses in certain circumstances. Please note that CVE-2022-39956 requires an updated modsecurity-apache package, which has been previously uploaded to buster-security, see Debian LTS Advisory DLA-3283-1 for details. If you are using some other solution in connection with the modsecurity-ruleset, for example one that it is using libmodsecurity3, your solution might error out with an error message like 'Error creating rule: Unknown variable: MULTIPART_PART_HEADERS'. In this case you can disable the mitigation for CVE-2022-29956 by removing the rule file REQUEST-922-MULTIPART-ATTACK.conf. However, be aware that this will disable the protection and could allow attackers to bypass your Web Application Firewall. There is no package in Debian which depends on libmodsecurity3, so if you are only using software which is available from Debian, you are not affected by this limitation. Kudos to @airween for the support and help while perparing the update. CVE-2018-16384 A SQL injection bypass (aka PL1 bypass) exists in OWASP ModSecurity Core Rule Set (owasp-modsecurity-crs) through v3.1.0-rc3 via {`a`b} where a is a special function name (such as if) and b is the SQL statement to be executed. CVE-2020-22669 Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at PL1) has a SQL injection bypass vulnerability. Attackers can use the comment characters and variable assignments in the SQL syntax to bypass Modsecurity WAF protection and implement SQL injection attacks on Web applications. CVE-2022-39955 The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass by submitting a specially crafted HTTP Content-Type header field that indicates multiple character encoding schemes. A vulnerable back-end can potentially be exploited by declaring multiple Content-Type charset names and therefore bypassing the configurable CRS Content-Type header charset allow list. An encoded payload can bypass CRS detection this way and may then be decoded by the backend. The legacy CRS versions 3.0.x and 3.1.x are affected, as well as the currently supported versions 3.2.1 and 3.3.2. Integrators and users are advised to upgrade to 3.2.2 and 3.3.3 respectively. CVE-2022-39956 The OWASP ModSecurity Core Rule Set (CRS) is affected by a partial rule set bypass for HTTP multipart requests by submitting a ... [Please see the references for more information on the vulnerabilities] Affected Software/OS: 'modsecurity-crs' package(s) on Debian 10. Solution: Please install the updated package(s). CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2018-16384 https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1167 https://lists.debian.org/debian-lts-announce/2023/01/msg00033.html Common Vulnerability Exposure (CVE) ID: CVE-2019-13464 https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1386 https://github.com/SpiderLabs/owasp-modsecurity-crs/pull/1391 Common Vulnerability Exposure (CVE) ID: CVE-2020-22669 https://github.com/coreruleset/coreruleset/pull/1793 https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1727 Common Vulnerability Exposure (CVE) ID: CVE-2022-39955 https://coreruleset.org/20220919/crs-version-3-3-3-and-3-2-2-covering-several-cves/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HL2L2GF7GOCWPMJZDUE5OXDSXHGG3XUJ/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YPQ6CCMX3MU4A7MTCGQJA7VMJW3IQDXV/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PD56EAYNGB6E6QQH62LAYCONOP6OH5DZ/ https://security.gentoo.org/glsa/202305-25 Common Vulnerability Exposure (CVE) ID: CVE-2022-39956 Common Vulnerability Exposure (CVE) ID: CVE-2022-39957 Common Vulnerability Exposure (CVE) ID: CVE-2022-39958
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.