Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 9.4 EUS rhel_eus:9.4::appstream | mod_security | 0:2.9.6-1.el9_4.2 |
| Red Hat · RHEL 9.4 EUS rhel_eus:9.4::appstream | mod_security-debuginfo | 0:2.9.6-1.el9_4.2 |
| Red Hat · RHEL 9.4 EUS rhel_eus:9.4::appstream | mod_security-debugsource | 0:2.9.6-1.el9_4.2 |
| Red Hat · RHEL 9.4 EUS rhel_eus:9.4::appstream | mod_security-mlogc | 0:2.9.6-1.el9_4.2 |
| Red Hat · RHEL 9.4 EUS rhel_eus:9.4::appstream | mod_security-mlogc-debuginfo | 0:2.9.6-1.el9_4.2 |
Vulnerabilities 1
-
High 7.5
ModSecurity has possible DoS vulnerability in sanitiseArg action
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The `sanitiseArg` (and `sanitizeAr…
References
-
article
https://access.redhat.com/security/updates/classification/#moderate
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2369827
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_13670.json
-
report
https://access.redhat.com/security/cve/CVE-2025-48866
-
advisory
https://www.cve.org/CVERecord?id=CVE-2025-48866
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-48866
-
article
https://github.com/owasp-modsecurity/ModSecurity/commit/3a54ccea62d3f7151bb08cb78d60c5e90b53ca2e
-
article
https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-859r-vvv8-rm8r
-
article
https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-f82j-8pp7-cw2w
-
article
https://github.com/owasp-modsecurity/ModSecurity/wiki/Reference-Manual-(v2.x)#sanitisearg