Debian alert DLA-3031-1 (modsecurity-apache)

From:
             
 
Chris Lamb <lamby@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 3031-1] modsecurity-apache security update
Date:
             
 
Sat, 28 May 2022 03:43:01 -0400
Message-ID:
             
 
<165372375119.1370200.15862869656240102164@copycat>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-3031-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                           Chris Lamb
May 28, 2022                                  https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : modsecurity-apache
Version        : 2.9.1-2+deb9u1
CVE ID         : CVE-2021-42717

It was discovered that there was a potential resource exhaustion
attack in modsecurity-apache, an Apache module which inspects HTTP
requests with the aim of preventing typical web application attacks
such as XSS and SQL.

For Debian 9 "Stretch", this problem has been fixed in version
2.9.1-2+deb9u1.

We recommend that you upgrade your modsecurity-apache packages.

For the detailed security status of modsecurity-apache please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/modsecurity-apache

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAmKR0mUACgkQHpU+J9Qx
Hlhztg//a1YoA/Lh4fnfsj9ouXEx7YO/ba2R3GqVXrQvhejMfDLu9jVHccOa3f1p
1M9IwPAw61hXXsp/YpRPJ28YBVLs7s0XTnsSQP+Wd8B6byS+s5ICL4FRU/y2oias
TaOBguGb/U8Qn/TdPvGdb8V+4V6CNIl+YF4LYGiUfpMTi4Jt+8DoZqVqOwH6jAQc
kMiW2nhjThjh9Uytq78cZ/4e5+j7C/mhTF61iAYeGcNHuJU1kOie1MazLQlyD0oH
slyP+RNT+iuHoRmxYBEHvUdqBwv0KaKzBvz1q8YoMa7e/iacDhnY0GxCwqTytwSv
ukB0ACX78fN64qc+Cp0yeqJgly+J/4s21w7FBgy3ksJK7xTYLTlHe0Jl+AQpw7up
txyoH9Da151zL8CoLtiTpxiOvXb8a6q6FQX5DSF56c+9Nx296iHsL/HJjwiqQphI
y215T36k2lboP+gtLCc3Arew4vQxgGJdcO/aYgN00n8oZdtFWQXIEmHD0rRV5AAy
YHtZ++g9j29viM0rW4zhtpHGIUfFvEr7Z05BPbmOSK5w+KAOpFpc17/sahY1Ut0y
iv95f52RDfkwDerVzfjH3yRFc5/C9ngZoyVT5WPWn63l2K5WzG/0Nx128tHPgHn9
V5mkpCQvD4WCXWgqvAz6HOwOMxmfVj8ji5o+r++eMIuKg+H7X6I=
=GOA9
-----END PGP SIGNATURE-----