modsecurity: ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects
CVE-2021-42717 is fixed in 3 products on 1 platform, first by DEBIAN-CVE-2021-42717, released December 7, 2021. It is not reported as exploited. Patch Radar priority: High.
ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web server being unable to service legitimate requests. Even a moderately large (e.g., 300KB) HTTP request can occupy one of the limited NGINX worker processes for minutes and consume almost all of the available CPU on the machine. Modsecurity 2 is similarly vulnerable: the affected versions include 2.8.0 through 2.9.4.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| libapache2-mod-security2 · Ubuntu 18.04.6 LTS (bionic) | 2.9.2-1ubuntu0.1~esm1 | libapache2-mod-security2 2.9.2-1ubuntu0.1~esm1 | Jan 20, 2023 |
| libapache2-mod-security2 · Ubuntu 20.04 LTS (focal) | 2.9.3-1ubuntu0.1 | libapache2-mod-security2 2.9.3-1ubuntu0.1 | Jan 20, 2023 |
| modsecurity · Debian 12.15 (bookworm) | 3.0.6-1 | DEBIAN-CVE-2021-42717 | Dec 7, 2021 |
| modsecurity · Debian 13.5 (trixie) | 3.0.6-1 | DEBIAN-CVE-2021-42717 | Dec 7, 2021 |
| modsecurity · Debian 14 | 3.0.6-1 | DEBIAN-CVE-2021-42717 | Dec 7, 2021 |
| modsecurity-apache · Debian 11.6 (bullseye) | 2.9.3-3+deb11u1 | DSA-5023-1 | Dec 18, 2021 |
| modsecurity-apache · Debian 12.15 (bookworm) | 2.9.5-1 | DEBIAN-CVE-2021-42717 | Dec 7, 2021 |
| modsecurity-apache · Debian 13.5 (trixie) | 2.9.5-1 | DEBIAN-CVE-2021-42717 | Dec 7, 2021 |
| modsecurity-apache · Debian 14 | 2.9.5-1 | DEBIAN-CVE-2021-42717 | Dec 7, 2021 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.