CVE-2022-48279
Fixed in a distro release EPSS 1%CVSS 7.5
In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall. NOTE: this is related to CVE-2022-39956 but can be considered independent changes to the ModSecurity (C language) codebase.
Products: owasp modsecurity, trustwave modsecurity, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | mod_security | 2.9.7-1.amzn2.0.1 |
| Amazon Linux 2 | mod_security-mlogc | 2.9.7-1.amzn2.0.1 |
| Debian 10 | modsecurity-apache | 2.9.3-1+deb10u2 |
| Debian 12 | modsecurity | 3.0.8-1 |
| Debian 12 | modsecurity-apache | 2.9.6-1 |
| Debian 13 | modsecurity | 3.0.8-1 |
| Debian 13 | modsecurity-apache | 2.9.6-1 |
| Debian 14 | modsecurity | 3.0.8-1 |
| Debian 14 | modsecurity-apache | 2.9.6-1 |
| Red Hat jboss core services 1 | jbcs-httpd24-apr | 0:1.7.0-8.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-apr | 0:1.7.0-8.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-debuginfo | 0:1.7.0-8.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-debuginfo | 0:1.7.0-8.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-devel | 0:1.7.0-8.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-apr-devel | 0:1.7.0-8.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-curl | 0:8.2.1-1.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-curl | 0:8.2.1-1.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-curl-debuginfo | 0:8.2.1-1.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-curl-debuginfo | 0:8.2.1-1.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd | 0:2.4.57-5.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd | 0:2.4.57-5.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-debuginfo | 0:2.4.57-5.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-debuginfo | 0:2.4.57-5.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-devel | 0:2.4.57-5.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-devel | 0:2.4.57-5.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-manual | 0:2.4.57-5.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-manual | 0:2.4.57-5.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-selinux | 0:2.4.57-5.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-selinux | 0:2.4.57-5.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-tools | 0:2.4.57-5.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-tools | 0:2.4.57-5.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-httpd-tools-debuginfo | 0:2.4.57-5.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl | 0:8.2.1-1.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl | 0:8.2.1-1.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl-debuginfo | 0:8.2.1-1.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl-devel | 0:8.2.1-1.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-libcurl-devel | 0:8.2.1-1.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ldap | 0:2.4.57-5.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ldap | 0:2.4.57-5.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ldap-debuginfo | 0:2.4.57-5.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_html | 1:2.4.57-5.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_html | 1:2.4.57-5.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_proxy_html-debuginfo | 1:2.4.57-5.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_security | 0:2.9.3-29.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_security | 0:2.9.3-29.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_security-debuginfo | 0:2.9.3-29.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_security-debuginfo | 0:2.9.3-29.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_session | 0:2.4.57-5.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_session | 0:2.4.57-5.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_session-debuginfo | 0:2.4.57-5.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ssl | 1:2.4.57-5.el8jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ssl | 1:2.4.57-5.el7jbcs |
| Red Hat jboss core services 1 | jbcs-httpd24-mod_ssl-debuginfo | 1:2.4.57-5.el8jbcs |
| SUSE Enterprise Storage 6 | apache2-mod_security2 | 2.9.2-150000.3.6.1 |
| SUSE Enterprise Storage 7 | apache2-mod_security2 | 2.9.2-150000.3.6.1 |
| SUSE Enterprise Storage 7.1 | apache2-mod_security2 | 2.9.2-150000.3.6.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS | apache2-mod_security2 | 2.9.2-150000.3.6.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | apache2-mod_security2 | 2.9.2-150000.3.6.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS | apache2-mod_security2 | 2.9.2-150000.3.6.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | apache2-mod_security2 | 2.9.2-150000.3.6.1 |
| SUSE Linux Enterprise Module for Server Applications 15 SP4 | apache2-mod_security2 | 2.9.4-150400.3.3.1 |
| SUSE Linux Enterprise Real Time 15 SP3 | apache2-mod_security2 | 2.9.2-150000.3.6.1 |
| SUSE Linux Enterprise Server 12 SP2-BCL | apache2-mod_security2 | 2.8.0-7.6.1 |
| SUSE Linux Enterprise Server 12 SP4-LTSS | apache2-mod_security2 | 2.8.0-7.6.1 |
| SUSE Linux Enterprise Server 12 SP5 | apache2-mod_security2 | 2.8.0-7.6.1 |
| SUSE Linux Enterprise Server 15 SP1-LTSS | apache2-mod_security2 | 2.9.2-150000.3.6.1 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | apache2-mod_security2 | 2.9.2-150000.3.6.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | apache2-mod_security2 | 2.9.2-150000.3.6.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | apache2-mod_security2 | 2.8.0-7.6.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | apache2-mod_security2 | 2.8.0-7.6.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | apache2-mod_security2 | 2.9.2-150000.3.6.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | apache2-mod_security2 | 2.9.2-150000.3.6.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | apache2-mod_security2 | 2.9.2-150000.3.6.1 |
| SUSE Manager Proxy 4.2 | apache2-mod_security2 | 2.9.2-150000.3.6.1 |
| SUSE Manager Retail Branch Server 4.2 | apache2-mod_security2 | 2.9.2-150000.3.6.1 |
| SUSE Manager Server 4.2 | apache2-mod_security2 | 2.9.2-150000.3.6.1 |
| SUSE OpenStack Cloud 9 | apache2-mod_security2 | 2.8.0-7.6.1 |
| SUSE OpenStack Cloud Crowbar 9 | apache2-mod_security2 | 2.8.0-7.6.1 |
| Ubuntu 20.04 LTS | modsecurity | no fix |
| Ubuntu 20.04 LTS | modsecurity-apache | 2.9.3-1ubuntu0.1 |
| Ubuntu 22.04 LTS | modsecurity | no fix |
| Ubuntu Pro 14.04 LTS | modsecurity-apache | 2.7.7-2ubuntu0.1~esm1 |
| Ubuntu Pro 16.04 LTS | modsecurity-apache | 2.9.0-1ubuntu0.1~esm1 |
| Ubuntu Pro 18.04 LTS | modsecurity-apache | 2.9.2-1ubuntu0.1~esm1 |
| Ubuntu Pro 22.04 LTS | modsecurity-apache | 2.9.5-1ubuntu0.1~esm1 |
| openSUSE Leap 15.4 | apache2-mod_security2 | 2.9.4-150400.3.3.1 |
| openSUSE Tumbleweed | apache2-mod_security2 | 2.9.8-2.1 |