Upstream information

CVE-2020-15598 at MITRE

Description

** DISPUTED ** Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. NOTE: The discoverer reports "Trustwave has signaled they are disputing our claims." The CVE suggests that there is a security issue with how ModSecurity handles regular expressions that can result in a Denial of Service condition. The vendor does not consider this as a security issue because1) there is no default configuration issue here. An attacker would need to know that a rule using a potentially problematic regular expression was in place, 2) the attacker would need to know the basic nature of the regular expression itself to exploit any resource issues. It's well known that regular expression usage can be taxing on system resources regardless of the use case. It is up to the administrator to decide on when it is appropriate to trade resources for potential security benefit.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having moderate severity.

CVSS v2 Scores
  National Vulnerability Database
Base Score 5
Vector AV:N/AC:L/Au:N/C:N/I:N/A:P
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Partial
CVSS v3 Scores
  National Vulnerability Database
Base Score 7.5
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Impact None
Integrity Impact None
Availability Impact High
CVSSv3 Version 3.1
No SUSE Bugzilla entries cross referenced.

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
SUSE Package Hub 15 SP4
  • libmodsecurity3 >= 3.0.10-bp154.2.3.1
  • libmodsecurity3-32bit >= 3.0.10-bp154.2.3.1
  • libmodsecurity3-64bit >= 3.0.10-bp154.2.3.1
  • modsecurity >= 3.0.10-bp154.2.3.1
  • modsecurity-devel >= 3.0.10-bp154.2.3.1
 Patchnames:
openSUSE-2023-269
SUSE Package Hub 15 SP5
  • libmodsecurity3 >= 3.0.10-bp155.3.3.1
  • libmodsecurity3-32bit >= 3.0.10-bp155.3.3.1
  • libmodsecurity3-64bit >= 3.0.10-bp155.3.3.1
  • modsecurity >= 3.0.10-bp155.3.3.1
  • modsecurity-devel >= 3.0.10-bp155.3.3.1
 Patchnames:
openSUSE-2023-257
openSUSE Leap 15.4
  • libmodsecurity3 >= 3.0.10-bp154.2.3.1
  • libmodsecurity3-32bit >= 3.0.10-bp154.2.3.1
  • libmodsecurity3-64bit >= 3.0.10-bp154.2.3.1
  • modsecurity >= 3.0.10-bp154.2.3.1
  • modsecurity-devel >= 3.0.10-bp154.2.3.1
 Patchnames:
openSUSE-2023-269
openSUSE Leap 15.5
  • libmodsecurity3 >= 3.0.10-bp155.3.3.1
  • libmodsecurity3-32bit >= 3.0.10-bp155.3.3.1
  • libmodsecurity3-64bit >= 3.0.10-bp155.3.3.1
  • modsecurity >= 3.0.10-bp155.3.3.1
  • modsecurity-devel >= 3.0.10-bp155.3.3.1
 Patchnames:
openSUSE-2023-257
openSUSE Tumbleweed
  • libmodsecurity3 >= 3.0.6-1.1
  • libmodsecurity3-32bit >= 3.0.6-1.1
  • modsecurity >= 3.0.6-1.1
  • modsecurity-devel >= 3.0.6-1.1
 Patchnames:
openSUSE-Tumbleweed-2024-12118

SUSE Timeline for this CVE

CVE page created: Wed Sep 16 17:47:18 2020
CVE page last modified: Tue Sep 3 19:16:57 2024