Skip to content

modsecurity/3.0.13 package update #27701

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
philroche merged 1 commit into from
Sep 6, 2024
Merged

modsecurity/3.0.13 package update #27701

philroche merged 1 commit into from
Sep 6, 2024

Conversation

@octo-sts
Copy link
Contributor

@octo-sts octo-sts bot commented Sep 6, 2024

@octo-sts octo-sts bot added request-version-update request for a newer version of a package automated pr labels Sep 6, 2024
@github-actions
Copy link
Contributor

github-actions bot commented Sep 6, 2024

Package modsecurity: Click to expand/collapse

Package modsecurity:
Added: /usr/lib/libmodsecurity.so.3.0.13
Modified: /usr/bin/modsec-rules-check
Modified: /usr/include/modsecurity/actions/action.h
Modified: /usr/include/modsecurity/anchored_set_variable_translation_proxy.h
Modified: /usr/include/modsecurity/anchored_variable.h
Modified: /usr/include/modsecurity/modsecurity.h
Modified: /usr/include/modsecurity/rule.h
Modified: /usr/include/modsecurity/rule_message.h
Modified: /usr/include/modsecurity/rule_with_actions.h
Modified: /usr/include/modsecurity/rule_with_operator.h
Modified: /usr/include/modsecurity/rules_set.h
Modified: /usr/include/modsecurity/rules_set_properties.h
Modified: /usr/include/modsecurity/transaction.h
Modified: /usr/include/modsecurity/variable_origin.h
Modified: /usr/include/modsecurity/variable_value.h
Modified: /usr/lib/pkgconfig/modsecurity.pc
Deleted: /usr/lib/libmodsecurity.so.3.0.12

Package modsecurity-static: Click to expand/collapse

Package modsecurity-static:
Modified: /usr/lib/libmodsecurity.a

Package modsecurity-config: Click to expand/collapse

Package modsecurity-config:
Modified: /etc/modsecurity/modsecurity.conf-concurrent
Modified: /etc/modsecurity/modsecurity.conf-recommended

bincapz found differences: Click to expand/collapse

Deleted: modsecurity/usr/lib/libmodsecurity.so.3.0.12 [⚠️ MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
-MEDIUM evasion/base64/decode decode base64 strings base64_decode
-MEDIUM net/download download files - Failed to download
-MEDIUM net/http/cookies access HTTP resources using cookies Cookie
HTTP
-MEDIUM net/http/form/upload upload content via HTTP form POST
application/x-www-form-urlencoded
-MEDIUM net/http/post submit content to websites HTTP
POST
http
-MEDIUM net/ip/parse parses IP address (IPv4 or IPv6) inet_pton
-MEDIUM net/ip/string converts IP address from byte to string inet_ntoa
-MEDIUM net/upload uploads files UPLOAD_DIR
UPLOAD_FILE_LIMIT
UPLOAD_FILE_MODE
UploadFileLimit
UploadKeepFiles
-MEDIUM net/url/encode encodes URL, likely to pass GET variables urlencode
-MEDIUM ref/words/intercept References interception intercepted
-LOW crypto/aes Supports AES (Advanced Encryption Standard) AES
-LOW encoding/base64 Supports base64 encoded strings base64
-LOW fs/directory/create creates directories mkdir
-LOW fs/file/delete deletes files unlink
-LOW fs/permission/modify modifies file permissions fchmod
-LOW hash/md5 Uses the MD5 signature format md5:
-LOW kernel/platform system identification uname
-LOW net/hostport/parse Network address and service translation freeaddrinfo
getaddrinfo
-LOW net/http/request makes HTTP requests User-Agent
-LOW net/socket/listen listen on a socket accept
socket
-LOW net/url Handles URL strings RequestURI
-LOW process/thread_local_storage Uses glibc thread local storage __tls_get_addr
-LOW process/userid/set set real and effective user ID of current process setuid
-LOW random/insecure generate random numbers insecurely srand
-LOW ref/words/password references a 'password' sp_password

Deleted: modsecurity-static/var/lib/db/sbom/modsecurity-static-3.0.12-r1.spdx.json [⚠️ MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
-MEDIUM net/download download files downloadLocation
-LOW ref/site/url contains embedded HTTPS URLs https://spdx.org/spdxdocs/chainguard/melange/5ea1ec3a09df123b119ccded7e91

Deleted: modsecurity/var/lib/db/sbom/modsecurity-3.0.12-r1.spdx.json [⚠️ MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
-MEDIUM net/download download files downloadLocation
-LOW ref/site/url contains embedded HTTPS URLs https://spdx.org/spdxdocs/chainguard/melange/8d92cdc2e3a8937b976cb876c317

Added: modsecurity/usr/lib/libmodsecurity.so.3.0.13 [⚠️ MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM evasion/base64/decode decode base64 strings base64_decode
+MEDIUM net/download download files - Failed to download
DOWNLOADING
+MEDIUM net/http/cookies access HTTP resources using cookies Cookie
HTTP
+MEDIUM net/http/form/upload upload content via HTTP form POST
application/x-www-form-urlencoded
+MEDIUM net/http/post submit content to websites HTTP
POST
http
+MEDIUM net/ip/parse parses IP address (IPv4 or IPv6) inet_pton
+MEDIUM net/ip/string converts IP address from byte to string inet_ntoa
+MEDIUM net/upload uploads files UPLOAD_DIR
UPLOAD_FILE_LIMIT
UPLOAD_FILE_MODE
UploadFileLimit
UploadKeepFiles
+MEDIUM net/url/encode encodes URL, likely to pass GET variables urlencode
+MEDIUM ref/words/intercept References interception intercepted
+LOW crypto/aes Supports AES (Advanced Encryption Standard) AES
+LOW encoding/base64 Supports base64 encoded strings base64
+LOW fs/directory/create creates directories mkdir
+LOW fs/file/delete deletes files unlink
+LOW fs/permission/modify modifies file permissions fchmod
+LOW hash/md5 Uses the MD5 signature format md5:
+LOW kernel/platform system identification uname
+LOW net/hostport/parse Network address and service translation freeaddrinfo
getaddrinfo
+LOW net/http/request makes HTTP requests User-Agent
+LOW net/socket/listen listen on a socket accept
socket
+LOW net/url Handles URL strings RequestURI
+LOW process/thread_local_storage Uses glibc thread local storage __tls_get_addr
+LOW process/userid/set set real and effective user ID of current process setuid
+LOW random/insecure generate random numbers insecurely srand
+LOW ref/words/password references a 'password' sp_password

Added: modsecurity/var/lib/db/sbom/modsecurity-3.0.13-r0.spdx.json [⚠️ MEDIUM]

RISK KEY DESCRIPTION EVIDENCE
+MEDIUM net/download download files downloadLocation
+LOW ref/site/url contains embedded HTTPS URLs https://spdx.org/spdxdocs/chainguard/melange/3ca1c55bd7afde62d50440175977

Moved: modsecurity-config/var/lib/db/sbom/modsecurity-config-3.0.12-r1.spdx.json -> /tmp/wolfictl-apk-3935564753/modsecurity-static/var/lib/db/sbom/modsecurity-static-3.0.13-r0.spdx.json (similarity: 0.90)

Moved: modsecurity-config/var/lib/db/sbom/modsecurity-config-3.0.12-r1.spdx.json -> /tmp/wolfictl-apk-3935564753/modsecurity-config/var/lib/db/sbom/modsecurity-config-3.0.13-r0.spdx.json (similarity: 0.98)

@philroche philroche self-assigned this Sep 6, 2024
@philroche
Copy link
Member

philroche commented Sep 6, 2024

Changes summay:
Total files changed: 300

Total changes: 16395
Total additions: 5832
Total deletions: 10563

Total commits: 236

GitHub compare URL: owasp-modsecurity/ModSecurity@5f44383...580fe19

philroche
philroche approved these changes Sep 6, 2024
View reviewed changes
Copy link
Member

@philroche philroche left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a patch version bump.

All checks pass.

@philroche philroche merged commit dde4efc into main Sep 6, 2024
@philroche philroche deleted the wolfictl-cae61c57-eaf5-4a8c-9719-b12d30fa3061 branch September 6, 2024 08:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@philroche philroche philroche approved these changes

Assignees

@philroche philroche

Labels

automated pr request-version-update request for a newer version of a package service:bincapz/pass tests/missing

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@philroche @wolfi-bot