PatchTheCVEmod security vulnerabilities and fixes
Recent CVEs affecting mod security, with upgrade or downgrade steps. 3 tracked.
Also searched as: modsecurity.
mod security has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2007-03-08. Highest priority: CVE-2003-1171 (score 59/100).
- CVE-2007-1359 MEDIUM 6.8 DOWNGRADE Interpretation conflict in ModSecurity (mod_security) 2.1.0 and earlier allows remote attackers to bypass requ
- CVE-2004-1765 HIGH 7.5 DOWNGRADE Off-by-one buffer overflow in ModSecurity (mod_security) 1.7.4 for Apache 2.x, when SecFilterScanPost is enabl
- CVE-2003-1171 HIGH 7.5 DOWNGRADE Heap-based buffer overflow in the sec_filter_out function in mod_security 1.7RC1 through 1.7.1 in Apache 2 all
FAQ
How do I fix mod security vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is mod security being exploited right now?
None of the tracked mod security CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which mod security CVE should I patch first?
CVE-2003-1171 currently ranks highest (59/100): Heap-based buffer overflow in the sec_filter_out function in mod_security 1.7RC1 through 1.7.1 in Apache 2 all.