Total vulnerabilities in the database
ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web server being unable to service legitimate requests. Even a moderately large (e.g., 300KB) HTTP request can occupy one of the limited NGINX worker processes for minutes and consume almost all of the available CPU on the machine. Modsecurity 2 is similarly vulnerable: the affected versions include 2.8.0 through 2.9.4.
| Software | From | Fixed in |
|---|---|---|
| trustwave / modsecurity | 2.0.0 | 2.9.5 |
| trustwave / modsecurity | 3.0.0 | 3.0.6 |
| f5 / nginx_modsecurity_waf | r25 | r25.x |
| f5 / nginx_modsecurity_waf | r24 | r24.x |
| debian / debian_linux | 9.0 | 9.0.x |
| debian / debian_linux | 10.0 | 10.0.x |
| debian / debian_linux | 11.0 | 11.0.x |
| oracle / http_server | 12.2.1.3.0 | 12.2.1.3.0.x |
| oracle / http_server | 12.2.1.4.0 | 12.2.1.4.0.x |
| oracle / zfs_storage_appliance_kit | 8.8 | 8.8.x |