CVE-2020-15598 Denial of service in n/a
A specially crafted request can cause a denial of service in ModSecurity if specific regular expressions are configured, though the vendor disputes this as a security vulnerability.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-15598?
CVE-2020-15598 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 6 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. NOTE: The discoverer reports "Trustwave has signaled they are disputing our claims." The CVE suggests that there is a security issue with how ModSecurity handles regular expressions that can result in a Denial of Service condition. The vendor does not consider this as a security issue because1) there is no default configuration issue here. An attacker would need to know that a rule using a potentially problematic regular expression was in place, 2) the attacker would need to know the basic nature of the regular expression itself to exploit any resource issues. It's well known that regular expression usage can be taxing on system resources regardless of the use case. It is up to the administrator to decide on when it is appropriate to trade resources for potential security benefit
Weakness: CWE-835
Which versions are affected by CVE-2020-15598?
2 open source packages ship an affected version, including modsecurity and modsecurity2. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
modsecurity Bitnami | From 3.0.0 | 3.0.5 |
modsecurity2 Bitnami | From 3.0.0 | 3.0.5 |
Products include Debian Debian Linux, Owasp Modsecurity.
How do I fix CVE-2020-15598?
Upgrade modsecurity to 3.0.5 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-15598 being exploited?
There is no known exploitation of CVE-2020-15598 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as BIT-modsecurity-2020-15598, BIT-modsecurity2-2020-15598, DEBIAN-CVE-2020-15598, DSA-4765-1, GHSA-ff2c-wgr6-2p58.