mailing list archives
Re: CVE Request -- ModSecurity (X < 2.7.3): Vulnerable to XXE attacks
From: Breno Silva <breno.silva () gmail com>
Date: Mon, 8 Apr 2013 15:34:15 -0300
Are you guys backporting de patch to old versions of ModSecurity ?
On Wed, Apr 3, 2013 at 9:23 AM, Jan Lieskovsky <jlieskov () redhat com> wrote:
Hello Kurt, Steve, Breno, vendors,
ModSecurity upstream has released v2.7.3 version:
correcting one security flaw (from ):
"It was reported that the XML files parser of ModSecurity,
a security module for the Apache HTTP Server, was vulnerable
to XML External Entity attacks. A remote attacker could
provide a specially-crafted XML file that, when processed
might lead to local files disclosure or, potentially,
excessive resources (memory, CPU) consumption."
Relevant upstream patch (seems to be the following):
Could you allocate a CVE id [*] for this?
Thank you && Regards, Jan.
Jan iankko Lieskovsky / Red Hat Security Response Team
[*] According to:
there doesn't seem to have been a CVE id allocated for this issue yet.