Description
Trustwave ModSecurity 3.0.0 through 3.0.3 allows an attacker to send crafted requests that may, when sent quickly in large volumes, lead to the server becoming slow or unresponsive (Denial of Service) because of a flaw in Transaction::addRequestHeader in transaction.cc.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | modsecurity | 3.0.4-1 | — |
| Debian 13 | modsecurity | 3.0.4-1 | — |
| Debian 12 | modsecurity | 3.0.4-1 | — |
References
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-denial-of-service-details-cve-2019-19886/
- FEDORA-2020-1b5b3b465d vendor-advisory
- FEDORA-2020-f7ba0ac7a4 vendor-advisory
- FEDORA-2020-dc9aee5510 vendor-advisory