CVE-2021-42717

CWE-674 — Uncontrolled Recursion8 documents7 sources
Severity
7.5HIGH
EPSS
2.0%
top 16.17%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Owasp ModsecurityTrustwave ModsecurityDebian Debian Linux+3 more
Timeline
PublishedDec 7
Latest updateSep 14

Description

ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web server being unable to service legitimate requests. Even a moderately large (e.g., 300KB) HTTP request can occupy one of the limited NGINX worker processes for minutes and consume almost all of the available CPU on the machine. Modsecurity 2 is similarly vulnerable: the affected versions include 2.8.0 through 2.9.4.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages8 packages

▶NVDf5/nginx_modsecurity_wafr24, r25+1
▶NVDowasp/modsecurity3.0.0 — 3.0.6
▶NVDtrustwave/modsecurity2.0.0 — 2.9.5
▶Debianmodsecurity< 3.0.6-1+2
▶Debianmodsecurity-apache< 2.9.3-3+deb11u1+3

Also affects: Debian Linux 10.0, 11.0, 9.0

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

4
OSV
modsecurity-apache vulnerabilities↗2023-09-14
▶
GHSA
GHSA-w3vf-7fpc-9fww: ModSecurity 3↗2021-12-08
▶
OSV
CVE-2021-42717: ModSecurity 3↗2021-12-07
▶
CVEList
CVE-2021-42717: ModSecurity 3↗2021-12-07
▶

📋Vendor Advisories

3
Ubuntu
ModSecurity vulnerabilities↗2023-09-14
▶
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: SSL Module (ModSecurity) — CVE-2021-42717↗2023-01-15
▶
Debian
CVE-2021-42717: modsecurity - ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafte...↗2021
▶
CVE-2021-42717 (HIGH CVSS 7.5) | ModSecurity 3.x through 3.0.5 misha | cvebase.io