CVE-2022-39957

NameCVE-2022-39957
DescriptionThe OWASP ModSecurity Core Rule Set (CRS) is affected by a response body bypass. A client can issue an HTTP Accept header field containing an optional "charset" parameter in order to receive the response in an encoded form. Depending on the "charset", this response can not be decoded by the web application firewall. A restricted resource, access to which would ordinarily be detected, may therefore bypass detection. The legacy CRS versions 3.0.x and 3.1.x are affected, as well as the currently supported versions 3.2.1 and 3.3.2. Integrators and users are advised to upgrade to 3.2.2 and 3.3.3 respectively.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
Debian Bugs1021137

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
modsecurity-crs (PTS)buster3.1.0-1+deb10u2vulnerable
bullseye3.3.0-1+deb11u1vulnerable
bookworm, sid3.3.2-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
modsecurity-crssource(unstable)(unfixed)1021137

Notes

[bullseye] - modsecurity-crs <no-dsa> (Minor issues; will be fixed in point release)
https://coreruleset.org/20220919/crs-version-3-3-3-and-3-2-2-covering-several-cves/

Search for package or bug name: Reporting problems