Description
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Due to the misuse of `log.Fatalf`, the application using coraza crashed after receiving crafted requests from attackers. The application will immediately crash after receiving a malicious request that triggers an error in `mime.ParseMediaType`. This issue was patched in version 3.0.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| corazawaf | coraza | < 3.0.1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/corazawaf/coraza/v2 | >= 2.0.0, <= 2.0.1 | — | GHSA-c2pj-v37r-2p6h |
| Go | github.com/corazawaf/coraza/v2 | all versions | — | GO-2023-1874 |
| Go | github.com/corazawaf/coraza/v3 | >= 3.0.0, < 3.0.1 | 3.0.1 | GHSA-c2pj-v37r-2p6h |
| Go | github.com/corazawaf/coraza/v3 | < 3.0.1 | 3.0.1 | GO-2023-1874 |