Bug 2367903 (CVE-2025-47947)

Summary: CVE-2025-47947 modsecurity: ModSecurity Has Possible DoS Vulnerability
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: csutherl, jclere, mturk, pjindal, plodge, szappis
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the mod_security2 Apache2 module. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case. In stable released versions, when the payload's content type is `application/json`, at least one rule performs a `sanitiseMatchedBytes` action, a security control that automatically cleans or neutralizes specific patterns of potentially harmful data that prevents malicious input from reaching systems or sensitive information from leaking.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2367907, 2367908    
Bug Blocks:    

Description OSIDB Bzimport 2025-05-21 23:01:34 UTC
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case (in stable released versions): when the payload's content type is `application/json`, and there is at least one rule which does a `sanitiseMatchedBytes` action. A patch is available at pull request 3389 and expected to be part of version 2.9.9. No known workarounds are available.

Comment 2 errata-xmlrpc 2025-06-05 16:05:29 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2025:8605 https://access.redhat.com/errata/RHSA-2025:8605

Comment 3 errata-xmlrpc 2025-06-09 01:41:00 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support

Via RHSA-2025:8626 https://access.redhat.com/errata/RHSA-2025:8626

Comment 4 errata-xmlrpc 2025-06-09 01:43:28 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

Via RHSA-2025:8627 https://access.redhat.com/errata/RHSA-2025:8627

Comment 5 errata-xmlrpc 2025-06-09 13:50:42 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2025:8674 https://access.redhat.com/errata/RHSA-2025:8674

Comment 6 errata-xmlrpc 2025-06-11 10:48:11 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:8844 https://access.redhat.com/errata/RHSA-2025:8844

Comment 7 errata-xmlrpc 2025-06-11 10:50:14 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:8837 https://access.redhat.com/errata/RHSA-2025:8837

Comment 8 errata-xmlrpc 2025-06-11 15:58:52 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2025:8922 https://access.redhat.com/errata/RHSA-2025:8922

Comment 9 errata-xmlrpc 2025-06-11 16:00:34 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2025:8917 https://access.redhat.com/errata/RHSA-2025:8917

Comment 10 errata-xmlrpc 2025-06-11 21:33:14 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2025:8937 https://access.redhat.com/errata/RHSA-2025:8937

Comment 13 errata-xmlrpc 2025-08-14 13:41:41 UTC
This issue has been addressed in the following products:

  JBoss Core Services on RHEL 7
  JBoss Core Services for RHEL 8

Via RHSA-2025:13680 https://access.redhat.com/errata/RHSA-2025:13680

Comment 14 errata-xmlrpc 2025-08-14 13:51:13 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Core Services 2.4.62.SP1

Via RHSA-2025:13681 https://access.redhat.com/errata/RHSA-2025:13681