ModSecurity: Incorrect libcurl TLS hostname verification setting in HttpsClient::download

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, the HttpsClient::download function in src/utils/https_client.cc sets libcurl CURLOPT_SSL_VERIFYHOST to 1 instead of the strict value 2L. Under adversary-in-the-middle and TLS interception conditions, this non-strict setting may weaken TLS peer identity validation and increase the risk of accepting a certificate for an unintended host. End-to-end exploitation is non-trivial in typical environments. This issue is fixed in versions 2.9.15 and 3.0.17.

Etkilenen sürümler1 yazılım

Kaynaklar7 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…curity/security/advisories/GHSA-2vqc-36qp-ccmw Diğer
• github.com/…ommit/cce204806430e4848327aadeb9113e654631a0c1 Diğer
• github.com/…ommit/edca70d853bfb725325137fa40d178beebc324fc Diğer
• github.com/…p-modsecurity/ModSecurity/releases/tag/v2.9.15 Diğer
• github.com/…p-modsecurity/ModSecurity/releases/tag/v3.0.17 Diğer

Kayıt geçmişi

1. 5 Kas 2026 18:48Yayımlandı

İlgili açıklar

• 8,6 CVE-2026-104269ModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java)
• 8,6 CVE-2026-73856ModSecurity: Response Body Inspection Bypass
• 5,8 CVE-2026-103932ModSecurity: PCRE2 `@rxGlobal` match-limit errors are converted to no-match
• 7,4 CVE-2026-116789FreeSWITCH: DTLS-SRTP peer certificate is not bound to the SDP fingerprint when FreeSWITCH is the DTLS server
• 8,0 CVE-2026-96453Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates
• 7,4 CVE-2026-109408vault-java-driver: SslConfig TLS doğrulamasını sessizce devre dışı bırakıyor