{"answers":{"affected":"2 open source packages ship an affected version, including modsecurity and modsecurity2. It affects 2 products.","exploited":"There is no known exploitation of CVE-2020-15598 in the wild and no public exploit code.","fix":"Upgrade modsecurity to 3.0.5 or later.","what":"CVE-2020-15598 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 6 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2020-15598 and fix it if it is affected.\n\nWhat it is: CVE-2020-15598 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 6 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2020-15598 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- modsecurity (Bitnami): affected from 3.0.0; fixed in 3.0.5\n- modsecurity2 (Bitnami): affected from 3.0.0; fixed in 3.0.5\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2020-15598/ (Markdown: https://insights.sbomify.com/CVE-2020-15598/index.md)","id":"CVE-2020-15598","markdown":"https://insights.sbomify.com/CVE-2020-15598/index.md","name":"CVE-2020-15598","record":{"aliases":["BIT-modsecurity-2020-15598","BIT-modsecurity2-2020-15598","DEBIAN-CVE-2020-15598","DSA-4765-1","GHSA-ff2c-wgr6-2p58"],"analysis":{"component_type":"server_software","fix_type":"no_fix_stated","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":true,"product_category":"Web application firewall","requires_auth":"none","summary":"A specially crafted request can cause a denial of service in ModSecurity if specific regular expressions are configured, though the vendor disputes this as a security vulnerability.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"mitre","cpe":[{"product":"debian_linux","vendor":"debian"},{"product":"modsecurity","vendor":"owasp"}],"cvss":{"score":7.5,"severity":"high","source":"nvd","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-835","name":"Loop with Unreachable Exit Condition"}],"description":"Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. NOTE: The discoverer reports \"Trustwave has signaled they are disputing our claims.\" The CVE suggests that there is a security issue with how ModSecurity handles regular expressions that can result in a Denial of Service condition. The vendor does not consider this as a security issue because1) there is no default configuration issue here. An attacker would need to know that a rule using a potentially problematic regular expression was in place, 2) the attacker would need to know the basic nature of the regular expression itself to exploit any resource issues. It's well known that regular expression usage can be taxing on system resources regardless of the use case. It is up to the administrator to decide on when it is appropriate to trade resources for potential security benefit","ecosystems":["Bitnami"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Denial of service in n/a","id":"CVE-2020-15598","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Bitnami","product":"debian:debian_linux","products":["debian:debian_linux"],"type":"denial_of_service","year":"2020"},"n_packages":2,"n_references":5,"next":{"headline":"Cross-site scripting in n/a","id":"CVE-2020-15599"},"packages":[{"ecosystem":"Bitnami","fixed":["3.0.5"],"introduced":["3.0.0"],"last_affected":[],"package":"modsecurity","purl":"pkg:bitnami/modsecurity","source":"BIT-modsecurity-2020-15598"},{"ecosystem":"Bitnami","fixed":["3.0.5"],"introduced":["3.0.0"],"last_affected":[],"package":"modsecurity2","purl":"pkg:bitnami/modsecurity2","source":"BIT-modsecurity2-2020-15598"}],"prev":{"headline":"Cross-site scripting in n/a","id":"CVE-2020-15597"},"products":["n/a"],"published":"2020-10-06","related":[{"cvss_score":10,"headline":"ProFTPD Improper Access Control","id":"CVE-2015-3306","kev_date_added":"2026-10-08","published":"2015-05-18"},{"cvss_score":9.9,"headline":"RoundCube Webmail Deserialization of Untrusted Data","id":"CVE-2025-49113","kev_date_added":"2026-02-20","published":"2025-06-02"},{"cvss_score":9.8,"headline":"GNU InetUtils Argument Injection","id":"CVE-2026-24061","kev_date_added":"2026-01-26","published":"2026-01-21"},{"cvss_score":9.8,"headline":"Linux Kernel Improper Check for Unusual or Exceptional Conditions","id":"CVE-2025-39682","kev_date_added":"2026-09-18","published":"2025-09-05"},{"cvss_score":9.8,"headline":"Mozilla Firefox Use-After-Free","id":"CVE-2024-9680","kev_date_added":"2024-10-15","published":"2024-10-09"},{"cvss_score":9.8,"headline":"RARLAB UnRAR Directory Traversal","id":"CVE-2022-30333","kev_date_added":"2022-08-09","published":"2022-05-09"},{"cvss_score":9.8,"headline":"Roundcube Webmail SQL Injection","id":"CVE-2021-44026","kev_date_added":"2023-06-22","published":"2021-11-19"}],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"Bitnami","prefix":"BIT"},{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-08-04","vendors":["n/a"]},"summary":"A specially crafted request can cause a denial of service in ModSecurity if specific regular expressions are configured, though the vendor disputes this as a security vulnerability.","url":"https://insights.sbomify.com/CVE-2020-15598/"}