Sign-up

ID

VAR-202112-0385


CVE

CVE-2021-42717


TITLE

ModSecurity  Recursion control vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2021-016135

DESCRIPTION

ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web server being unable to service legitimate requests. Even a moderately large (e.g., 300KB) HTTP request can occupy one of the limited NGINX worker processes for minutes and consume almost all of the available CPU on the machine. Modsecurity 2 is similarly vulnerable: the affected versions include 2.8.0 through 2.9.4. ModSecurity Exists in a recursive control vulnerability.Service operation interruption (DoS) It may be in a state. ModSecurity is an intrusion detection and prevention engine that can run as a module of the Apache web server or as a separate application to enhance the security of web applications and protect web applications from known and unknown attacks. The update introduces a new 'SecRequestBodyJsonDepthLimit' option to limit the maximum request body JSON parsing depth which ModSecurity will accept (defaults to 10000). For the oldstable distribution (buster), this problem has been fixed in version 2.9.3-1+deb10u1. For the stable distribution (bullseye), this problem has been fixed in version 2.9.3-3+deb11u1. We recommend that you upgrade your modsecurity-apache packages. For the detailed security status of modsecurity-apache please refer to its security tracker page at: https://security-tracker.debian.org/tracker/modsecurity-apache Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmG93fFfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2 NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND z0TISQ/9FDNX/GMbzanT4mYbAIXAbQ8tHGJhJVifHwnM8VcUv5xCecJDsHs5rg65 XSgAw7kyG17TotGrU+m8rhqbNrwcCnPAI5YqcxSKASim1Seu7Teayle+bDDTraHQ oTpNGaZ1aTaKtsQ3+TpHmsOoMcBivGX+ay7GldRO3krebAVAZEx8Y824tt/2jer5 XEM5XXkQA8fjRyr8K/JpdxivGCRL20KKg3dOLrUrw6UP8l/avd66ORGxCWRQ4abN RoCu2NkZul558kYa7q95DJy1Hwa0OHygq+wjeQnojJMsup/WD+YcRclbEJsEVG/s DEr3mYvekgtn0UlaRJWJNtknqUNHg67rts3wwlmXOLsLg1Darjm5HiowUMy8cki0 jvST+Zb5UdGO02Fj5xch/lP1VABpcra19+XGs1yNrAXhiE7FUZMCXlZqRgRKWx5O ueKIP7PAEp9TIaOA+H33y9y3EAWnM2l3BbstBV28d8rBecIHzRnkd4HQ2XgTh1Sd rM4a5KmADtWAdya4aRev1Qyr3qBEEU8q4A1TRMRLvBHosIETr6P0//+0dua97oE/ C8+sHm+CLo6scuD65Xpuyjv/zHPuxXSXN/Fkp6qgxhcH7MGwRbXx8JwsAWmGfWSL pjAcO7UMz0dLCR8hxpzsGLgjKQVC/STyh+ufHK5oEid41Z4PW60= =9Flq -----END PGP SIGNATURE----- . ========================================================================== Ubuntu Security Notice USN-6370-1 September 14, 2023 modsecurity-apache vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.04 LTS (Available with Ubuntu Pro) - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS (Available with Ubuntu Pro) - Ubuntu 16.04 LTS (Available with Ubuntu Pro) - Ubuntu 14.04 LTS (Available with Ubuntu Pro) Summary: Several security issues were fixed in ModSecurity. Software Description: - modsecurity-apache: Tighten web applications security for Apache Details: It was discovered that ModSecurity incorrectly handled certain nested JSON objects. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-42717) It was discovered that ModSecurity incorrectly handled certain HTTP multipart requests. A remote attacker could possibly use this issue to bypass ModSecurity restrictions. (CVE-2022-48279) It was discovered that ModSecurity incorrectly handled certain file uploads. A remote attacker could possibly use this issue to cause a buffer overflow and a firewall failure. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2023-24021) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 22.04 LTS (Available with Ubuntu Pro): libapache2-mod-security2 2.9.5-1ubuntu0.1~esm1 Ubuntu 20.04 LTS: libapache2-mod-security2 2.9.3-1ubuntu0.1 Ubuntu 18.04 LTS (Available with Ubuntu Pro): libapache2-mod-security2 2.9.2-1ubuntu0.1~esm1 Ubuntu 16.04 LTS (Available with Ubuntu Pro): libapache2-mod-security2 2.9.0-1ubuntu0.1~esm1 libapache2-modsecurity 2.9.0-1ubuntu0.1~esm1 Ubuntu 14.04 LTS (Available with Ubuntu Pro): libapache2-mod-security2 2.7.7-2ubuntu0.1~esm1 libapache2-modsecurity 2.7.7-2ubuntu0.1~esm1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6370-1 CVE-2021-42717, CVE-2022-48279, CVE-2023-24021 Package Information: https://launchpad.net/ubuntu/+source/modsecurity-apache/2.9.3-1ubuntu0.1

Trust: 1.98

sources: NVD: CVE-2021-42717 // JVNDB: JVNDB-2021-016135 // VULHUB: VHN-403784 // VULMON: CVE-2021-42717 // PACKETSTORM: 169177 // PACKETSTORM: 174673

AFFECTED PRODUCTS

vendor:oraclemodel:http serverscope:eqversion:12.2.1.4.0

Trust: 1.0

vendor:oraclemodel:zfs storage appliance kitscope:eqversion:8.8

Trust: 1.0

vendor:trustwavemodel:modsecurityscope:gteversion:2.0.0

Trust: 1.0

vendor:f5model:nginx modsecurity wafscope:eqversion:r24

Trust: 1.0

vendor:trustwavemodel:modsecurityscope:ltversion:2.9.5

Trust: 1.0

vendor:f5model:nginx modsecurity wafscope:eqversion:r25

Trust: 1.0

vendor:trustwavemodel:modsecurityscope:gteversion:3.0.0

Trust: 1.0

vendor:trustwavemodel:modsecurityscope:ltversion:3.0.6

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:10.0

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:11.0

Trust: 1.0

vendor:oraclemodel:http serverscope:eqversion:12.2.1.3.0

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:9.0

Trust: 1.0

vendor:オラクルmodel:zfs storage appliance kitscope: - version: -

Trust: 0.8

vendor:オラクルmodel:oracle http serverscope: - version: -

Trust: 0.8

vendor:trustwavemodel:modsecurityscope: - version: -

Trust: 0.8

vendor:debianmodel:gnu/linuxscope: - version: -

Trust: 0.8

vendor:f5model:nginx modsecurity wafscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2021-016135 // NVD: CVE-2021-42717

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-42717
value: HIGH

Trust: 1.0

NVD: CVE-2021-42717
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202112-519
value: HIGH

Trust: 0.6

VULHUB: VHN-403784
value: MEDIUM

Trust: 0.1

VULMON: CVE-2021-42717
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-42717
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-403784
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-42717
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: CVE-2021-42717
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-403784 // VULMON: CVE-2021-42717 // JVNDB: JVNDB-2021-016135 // CNNVD: CNNVD-202112-519 // NVD: CVE-2021-42717

PROBLEMTYPE DATA

problemtype:CWE-674

Trust: 1.1

problemtype:Inappropriate recursive control (CWE-674) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-403784 // JVNDB: JVNDB-2021-016135 // NVD: CVE-2021-42717

THREAT TYPE

remote

Trust: 0.7

sources: PACKETSTORM: 174673 // CNNVD: CNNVD-202112-519

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202112-519

PATCH

title:Oracle Critical Patch Update Advisory - April 2022url:https://lists.debian.org/debian-lts-announce/2022/05/msg00042.html

Trust: 0.8

title:Debian Security Advisories: DSA-5023-1 modsecurity-apache -- security updateurl:https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories&qid=76c1c060a3657c796d670a8c1cc60cc8

Trust: 0.1

title: - url:https://github.com/EkamSinghWalia/Detection-and-Mitigation-script-for-CVE-2021-42717

Trust: 0.1

sources: VULMON: CVE-2021-42717 // JVNDB: JVNDB-2021-016135

EXTERNAL IDS

db:NVDid:CVE-2021-42717

Trust: 3.6

db:JVNDBid:JVNDB-2021-016135

Trust: 0.8

db:CNNVDid:CNNVD-202112-519

Trust: 0.7

db:PACKETSTORMid:169177

Trust: 0.7

db:AUSCERTid:ESB-2021.4312

Trust: 0.6

db:CS-HELPid:SB2021121901

Trust: 0.6

db:VULHUBid:VHN-403784

Trust: 0.1

db:VULMONid:CVE-2021-42717

Trust: 0.1

db:PACKETSTORMid:174673

Trust: 0.1

sources: VULHUB: VHN-403784 // VULMON: CVE-2021-42717 // JVNDB: JVNDB-2021-016135 // PACKETSTORM: 169177 // PACKETSTORM: 174673 // CNNVD: CNNVD-202112-519 // NVD: CVE-2021-42717

REFERENCES

url:https://www.debian.org/security/2021/dsa-5023

Trust: 1.9

url:https://www.oracle.com/security-alerts/cpuapr2022.html

Trust: 1.8

url:https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-dos-vulnerability-in-json-parsing-cve-2021-42717/

Trust: 1.8

url:https://lists.debian.org/debian-lts-announce/2022/05/msg00042.html

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2021-42717

Trust: 1.0

url:https://www.auscert.org.au/bulletins/esb-2021.4312

Trust: 0.6

url:https://packetstormsecurity.com/files/169177/debian-security-advisory-5023-1.html

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021121901

Trust: 0.6

url:https://vigilance.fr/vulnerability/modsecurity-overload-via-nested-json-objects-37106

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/674.html

Trust: 0.1

url:https://github.com/ekamsinghwalia/detection-and-mitigation-script-for-cve-2021-42717

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://www.debian.org/security/faq

Trust: 0.1

url:https://security-tracker.debian.org/tracker/modsecurity-apache

Trust: 0.1

url:https://www.debian.org/security/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-48279

Trust: 0.1

url:https://ubuntu.com/security/notices/usn-6370-1

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/modsecurity-apache/2.9.3-1ubuntu0.1

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2023-24021

Trust: 0.1

sources: VULHUB: VHN-403784 // VULMON: CVE-2021-42717 // JVNDB: JVNDB-2021-016135 // PACKETSTORM: 169177 // PACKETSTORM: 174673 // CNNVD: CNNVD-202112-519 // NVD: CVE-2021-42717

CREDITS

Debian

Trust: 0.1

sources: PACKETSTORM: 169177

SOURCES

db:VULHUBid:VHN-403784
db:VULMONid:CVE-2021-42717
db:JVNDBid:JVNDB-2021-016135
db:PACKETSTORMid:169177
db:PACKETSTORMid:174673
db:CNNVDid:CNNVD-202112-519
db:NVDid:CVE-2021-42717

LAST UPDATE DATE

2024-08-14T12:45:30.821000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-403784date:2022-09-03T00:00:00
db:VULMONid:CVE-2021-42717date:2022-09-03T00:00:00
db:JVNDBid:JVNDB-2021-016135date:2022-12-07T05:40:00
db:CNNVDid:CNNVD-202112-519date:2022-12-09T00:00:00
db:NVDid:CVE-2021-42717date:2022-09-03T03:33:10.373

SOURCES RELEASE DATE

db:VULHUBid:VHN-403784date:2021-12-07T00:00:00
db:VULMONid:CVE-2021-42717date:2021-12-07T00:00:00
db:JVNDBid:JVNDB-2021-016135date:2022-12-07T00:00:00
db:PACKETSTORMid:169177date:2021-12-28T20:12:00
db:PACKETSTORMid:174673date:2023-09-15T13:52:07
db:CNNVDid:CNNVD-202112-519date:2021-12-07T00:00:00
db:NVDid:CVE-2021-42717date:2021-12-07T22:15:06.950