Skip to content
OpenAdvisories
High ALAS2-2023-2098 2 CVEs

Important: mod_security security update (Amazon Linux 2)

Published Jun 21, 2023 · Updated Jun 29, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-24021: In ModSecurity before 2.9.7, FILES_TMP_CONTENT sometimes lacked the complete content. This can lead to a Web Application Firewall bypass. CVE-2022-48279: In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall. NOTE: this is related to CVE-2022-39956 but can be considered independent changes to the ModSecurity (C language) codebase.

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2 mod_security 0:2.9.7-1.amzn2.0.1
Amazon Linux · 2 mod_security-debuginfo 0:2.9.7-1.amzn2.0.1
Amazon Linux · 2 mod_security-mlogc 0:2.9.7-1.amzn2.0.1

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-48279.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-24021.html