| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: modsecurity | Distribution: openSUSE Tumbleweed |
| Version: 3.0.15 | Vendor: openSUSE |
| Release: 2.2 | Build date: Wed May 6 15:58:07 2026 |
| Group: Productivity/Networking/Security | Build host: reproducible |
| Size: 29309 | Source RPM: modsecurity-3.0.15-2.2.src.rpm |
| Packager: http://bugs.opensuse.org | |
| Url: https://www.modsecurity.org/ | |
| Summary: Web application firewall engine | |
ModSecurity is a toolkit for real-time web application monitoring, logging, and access control.
Apache-2.0
* Wed May 06 2026 Andreas Stieger <andreas.stieger@gmx.de>
- update to 3.0.15:
* CVE-2026-42268: unsig integer underflow issue in verify*
operators (boo#1266247)
* CVE-2026-30923: buffer overflow in hex_decode.cc (boo#1264223)
* buffer overflow in multipart body proc
* heap buffer overflow in acmp pm
* nullptr dereference in seclang scanner
* probably UB (left shift of neg. val) in ip_tree
* Add initial mbedTLS v4 support
* Update SQLi/XSS operators for libinjection v4.0.0
* Wed Mar 19 2025 Andreas Stieger <andreas.stieger@gmx.de>
- update to 3.0.14:
* changed t:htmlEntityDecode transformation
CVE-2025-27110 boo#1238061
* add value checking to @validateByteRange operator
* aligned TIME_MON variable's behavior
* Leverage std::make_unique & std::make_shared to create objects in the heap
* Simplified handling of RuleMessage by removing usage of std::shared_ptr
* Simplified constructors, copy constructors & assignment operators
- new upstream
- add upstream signing key and validate source signature
- drop build dependencies no longer needed
- build with support for curl, MaxMindDB, ssdeep (libfuzzy), yail
- build with pcre2 instead of pcre
- correct upstream license, it is Apache-2.0
* Tue Dec 03 2024 Flavio Castelli <fcastelli@suse.com>
- Update to version 3.0.13:
+ Added Windows port
+ Improved CI workflow
+ Removed unnecessary string copy operations, improved engine speed - several PR's
+ Fixed a bug in @pm operator
+ Extended the C/C++ API
* Thu Feb 15 2024 Dominique Leuenberger <dimstar@opensuse.org>
- Update to version 3.0.12:
+ Change REQUEST_FILENAME and REQUEST_BASENAME behavior
WAF bypass of the ModSecurity v3 release line for path-based
payloads by submitting a specially crafted request URL
(CVE-2024-1019).
+ Enhancements and bug fixes
- Set the minimum security protocol version (TLSv1.2) for
SecRemoteRules.
* Mon Jan 29 2024 Dirk Müller <dmueller@suse.com>
- update to 3.0.11:
* Add WRDE_NOCMD to wordexp call
* Fix: validateDTD compile fails if when libxml2 not
installed
* Fix memory leak of validateDTD's dtd object
* Fix memory leaks in ValidateSchema
* Add support for expirevar action
* Fix: lmdb regex match on non-null terminated string
* Fix memory leaks in lmdb code (new'd strings)
* Configure: add additional name to pcre2 pkg-config list
* Mon Sep 04 2023 David Anes <david.anes@suse.com>
- Update to version 3.0.10:
* Security impacting issue (fix bsc#1213702, CVE-2023-38285)
- Fix: worst-case time in implementation of four transformations
- Additional information on this issue is available at
https://www.trustwave.com/resources/blogs/spiderlabs-blog/modsecurity-v3-dos-vulnerability-in-four-transformations-cve-2023-38285/
* Enhancements and bug fixes
- Add TX synonym for MSC_PCRE_LIMITS_EXCEEDED
- Make MULTIPART_PART_HEADERS accessible to lua
- Fix: Lua scripts cannot read whole collection at once
- Fix: quoted Include config with wildcard
- Support isolated PCRE match limits
- Fix: meta actions not applied if multiMatch in first rule of chain
- Fix: audit log may omit tags when multiMatch
- Exclude CRLF from MULTIPART_PART_HEADER value
- Configure: use AS_ECHO_N instead echo -n
- Adjust position of memset from 2890
* Tue May 09 2023 Danilo Spinella <danilo.spinella@suse.com>
- Update to version 3.0.9:
* Add some member variable inits in Transaction class (possible segfault)
* Fix: possible segfault on reload if duplicate ip+CIDR in ip match list
* Resolve memory leak on reload (bison-generated variable)
* Support equals sign in XPath expressions
* Encode two special chars in error.log output
* Add JIT support for PCRE2
* Support comments in ipMatchFromFile file via '#' token
* Use name package name libmaxminddb with pkg-config
* Fix: FILES_TMP_CONTENT collection key should use part name
* Use AS_HELP_STRING instead of obsolete AC_HELP_STRING macro
* During configure, do not check for pcre if pcre2 specified
* Use pkg-config to find libxml2 first
* Fix two rule-reload memory leak issues
* Correct whitespace handling for Include directive
- Fix CVE-2023-28882, a segfault and a resultant crash of a worker process
in some configurations with certain inputs, bsc#1210993
* Fri Dec 16 2022 Michael Ströder <michael@stroeder.com>
- Update to version 3.0.8
* Adjust parser activation rules in modsecurity.conf-recommended [#2796]
* Multipart parsing fixes and new MULTIPART_PART_HEADERS collection [#2795]
* Prevent LMDB related segfault [#2755, #2761]
* Fix msc_transaction_cleanup function comment typo [#2788]
* Fix: MULTIPART_INVALID_PART connected to wrong internal variable [#2785]
* Restore Unique_id to include random portion after timestamp [#2752, #2758]
* Sun Aug 14 2022 Georg Pfuetzenreuter <georg.pfuetzenreuter@suse.com>
- Update to version 3.0.7
* Support PCRE2
* Support SecRequestBodyNoFilesLimit
* Add ctl:auditEngine action support
* Move PCRE2 match block from member variable
* Add SecArgumentsLimit, 200007 to modsecurity.conf-recommended
* Fix memory leak when concurrent log includes REMOTE_USER
* Fix LMDB initialization issues
* Fix initcol error message wording
* Tolerate other parameters after boundary in multipart C-T
* Add DebugLog message for bad pattern in rx operator
* Fix misuses of LMDB API
* Fix duplication typo in code comment
* Fix multiMatch msg, etc, population in audit log
* Fix some name handling for ARGS_*NAMES: regex SecRuleUpdateTargetById, etc.
* Adjust confusing variable name in setRequestBody method
* Multipart names/filenames may include single quote if double-quote enclosed
* Add SecRequestBodyJsonDepthLimit to modsecurity.conf-recommended
* Fri Feb 25 2022 Ferdinand Thiessen <rpm@fthiessen.de>
- Update to version 3.0.6
* Security issue: Support configurable limit on depth of JSON
parsing, possible DoS issue. CVE-2021-42717
- Update to version 3.0.5
* New: Having ARGS_NAMES, variables proxied
* Fix: FILES variable does not use multipart part name for key
* GeoIP: switch to GEOIP_MEMORY_CACHE from GEOIP_INDEX_CACHE
* Support configurable limit on number of arguments processed
* Adds support to lua 5.4
* Add support for new operator rxGlobal
* Fix: Replaces put with setenv in SetEnv action
* Fix: Regex key selection should not be case-sensitive
* Fix: Only delete Multipart tmp files after rules have run
* Fixed MatchedVar on chained rules
* Fix IP address logging in Section A
* Fix: rx: exit after full match (remove /g emulation); ensure
capture groups occuring after unused groups still populate TX vars
* Fix rule-update-target for non-regex
* Fix Security Impacting Issues:
* Handle URI received with uri-fragment, CVE-2020-15598
/usr/bin/modsec-rules-check /usr/share/licenses/modsecurity /usr/share/licenses/modsecurity/LICENSE
Generated by rpm2html 1.8.1
Fabrice Bellet, Sun Aug 2 04:42:17 2026