CVE-2021-42717
EUVD-2021-2967707.12.2021, 22:15
ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web server being unable to service legitimate requests. Even a moderately large (e.g., 300KB) HTTP request can occupy one of the limited NGINX worker processes for minutes and consume almost all of the available CPU on the machine. Modsecurity 2 is similarly vulnerable: the affected versions include 2.8.0 through 2.9.4.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| owasp | modsecurity | 3.0.0 ≤ 𝑥 < 3.0.6 |
| trustwave | modsecurity | 2.0.0 ≤ 𝑥 < 2.9.5 |
| debian | debian_linux | 9.0 |
| debian | debian_linux | 10.0 |
| debian | debian_linux | 11.0 |
| oracle | http_server | 12.2.1.3.0 |
| oracle | http_server | 12.2.1.4.0 |
| oracle | zfs_storage_appliance_kit | 8.8 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| modsecurity |
| ||||||||||||||||||||||
| modsecurity-apache |
|
Common Weakness Enumeration
References