CVE-2018-16384

NameCVE-2018-16384
DescriptionA SQL injection bypass (aka PL1 bypass) exists in OWASP ModSecurity Core Rule Set (owasp-modsecurity-crs) through v3.1.0-rc3 via {`a`b} where a is a special function name (such as "if") and b is the SQL statement to be executed.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3293-1, ELA-783-1
Debian Bugs924352

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
modsecurity-crs (PTS)jessie2.2.9-1+deb8u1vulnerable
stretch (lts), stretch3.2.3-0+deb9u1fixed
buster3.1.0-1+deb10u2vulnerable
buster (security)3.2.3-0+deb10u3fixed
bullseye3.3.0-1+deb11u1fixed
bookworm3.3.4-1fixed
sid, trixie3.3.5-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
modsecurity-crssourcestretch3.2.3-0+deb9u1ELA-783-1
modsecurity-crssourcebuster3.2.3-0+deb10u3DLA-3293-1
modsecurity-crssource(unstable)3.2.0-1low924352

Notes

[stretch] - modsecurity-crs <no-dsa> (Minor issue)
[jessie] - modsecurity-crs <no-dsa> (Minor issue)
https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1167
[wheezy] - modsecurity-crs <no-dsa> (Minor issue)

Search for package or bug name: Reporting problems