ModSecurity

ModSecurity copied to clipboard

Drop YAJL dependency

21

`yajl` library has been unmaintained upstream[1] since 2015. Last published release contians multiple CVEs (CVE-2023-33460, CVE-2022-24795, CVE-2017-16516) and fixes have had to be carried by downstream distributions and third parties....

mikelolasagasti

Missing transaction logs for blocked request ingress-nginx

6

**Describe the bug** We are missing transaction logs for some of the blocked requests. **Logs and dumps** 188#188: *3490527 [client my.ip] ModSecurity: Access denied with code 403 (phase 2). Matched...

mkuchniak

How to properly handle custom status after phase 3, 4 interception

4

ModSecurity version (and connector): ModSecurity v3.0.13 with nginx-connector v1.0.3 WebServer: nginx-1.27.2 OS (and distro): alpine:3.20.3 # Description I am trying to implement custom HTTP status codes for deny actions across...

meguoe

libModSecurity3: requests are blocked when `SecRequestBodyNoFilesLimit` is set to a very high value

1

**Describe the bug** When `SecRequestBodyNoFilesLimit` is set to a very high value, all requests get incorrectly blocked as being too large. This does not happen on Apache. **Logs and dumps**...

EsadCetiner

curl with PUT method can upload a huge file (>2GB) on remote server but hangs and timeout

6

**Describe the bug** When we want to upload a huge file (>2GB) to a remote web site (Artifactory in our case) , our http client hangs indefinitely. However, the file...

jonathansmith9485

Feature Request (v2): Add support for macro expansion for ipMatch operator

6

# Feature libModSecurity3 supports the use of transaction collection variables as an value when using the ipMatch operator, this isn't the case for ModSecurity2. For example. these rules work on...

EsadCetiner

After building a custom docker image with the new version of nginx, the modsecurity page is turned on and it becomes messy!

12

**Describe the bug** The latest version of nginx, I built my own docker image and used GitHub workflow to automatically execute it. Turning on modsecurity in the newly built nginx...

kejilion

Matched \"Operator `Eq' with parameter `0' against variable `REQUEST_HEADERS:Host' (Value: `0' )

5

ModSecurity does not recognize the Host header when using HTTP/3. I believe I have the correct versions of ModSecurity, the connector, and the rules. Is any custom configuration necessary to...

MorrowxD

Cannot seem to compile for Windows 32-bit (x86)

17

I cannot seem to compile LibModSecurity for windows 32-bit i have tried to no avail, i did manage to compile x64 with no problems through conan, but my application requires...

ElevationsRPG

I'm having trouble importing the modsecurity module into nginx.

7

Hey, Even though I made all the installations perfectly, the load module part I added to the conf configuration does not work at all. ``` **ldd** = libcurl-gnutls.so.4 => /lib/x86_64-linux-gnu/libcurl-gnutls.so.4...

MuhammetAliKara