add chained regex for rule 941310 to not match japan word 'company'
Resolves: rhbz#2040257
This commit is contained in:
parent
5ef7dd5617
commit
24147a7348
|
@ -0,0 +1,16 @@
|
||||||
|
--- a/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf 2020-07-01 18:38:19.000000000 +0200
|
||||||
|
+++ b/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf 2023-02-16 09:14:52.151838881 +0100
|
||||||
|
@@ -543,8 +543,11 @@
|
||||||
|
ctl:auditLogParts=+E,\
|
||||||
|
ver:'OWASP_CRS/3.3.4',\
|
||||||
|
severity:'CRITICAL',\
|
||||||
|
- setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
|
||||||
|
- setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
||||||
|
+ chain"
|
||||||
|
+ SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|REQUEST_FILENAME|XML:/* "@rx [^\xe4]\xbc[^\x9a][^\xbe>]*[^\xe7][^\xa4][\xbe>]|<[^\xbe]*[^\xe7][^\xa4]\xbe" \
|
||||||
|
+ "t:none,t:lowercase,t:urlDecode,t:htmlEntityDecode,t:jsDecode,\
|
||||||
|
+ setvar:'tx.xss_score=+%{tx.critical_anomaly_score}',\
|
||||||
|
+ setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}'"
|
||||||
|
|
||||||
|
#
|
||||||
|
# https://nedbatchelder.com/blog/200704/xss_with_utf7.html
|
|
@ -1,7 +1,7 @@
|
||||||
Summary: ModSecurity Rules
|
Summary: ModSecurity Rules
|
||||||
Name: mod_security_crs
|
Name: mod_security_crs
|
||||||
Version: 3.3.4
|
Version: 3.3.4
|
||||||
Release: 1%{?dist}
|
Release: 2%{?dist}
|
||||||
License: ASL 2.0
|
License: ASL 2.0
|
||||||
URL: https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project
|
URL: https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project
|
||||||
Group: System Environment/Daemons
|
Group: System Environment/Daemons
|
||||||
|
@ -10,6 +10,7 @@ BuildArch: noarch
|
||||||
Requires: mod_security >= 2.8.0
|
Requires: mod_security >= 2.8.0
|
||||||
Obsoletes: mod_security_crs-extras < 3.0.0
|
Obsoletes: mod_security_crs-extras < 3.0.0
|
||||||
Patch0: mod_security_crs-early-blocking.patch
|
Patch0: mod_security_crs-early-blocking.patch
|
||||||
|
Patch1: mod_security_crs-rule-941310-dont-match-japanese-word.patch
|
||||||
|
|
||||||
%description
|
%description
|
||||||
This package provides the base rules for mod_security.
|
This package provides the base rules for mod_security.
|
||||||
|
@ -17,6 +18,7 @@ This package provides the base rules for mod_security.
|
||||||
%prep
|
%prep
|
||||||
%setup -q -n coreruleset-%{version}
|
%setup -q -n coreruleset-%{version}
|
||||||
%patch0 -p1 -b.early_blocking
|
%patch0 -p1 -b.early_blocking
|
||||||
|
%patch1 -p1 -b.rule_941310
|
||||||
|
|
||||||
%build
|
%build
|
||||||
|
|
||||||
|
@ -48,6 +50,10 @@ done
|
||||||
%{_datarootdir}/mod_modsecurity_crs
|
%{_datarootdir}/mod_modsecurity_crs
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Fri Mar 31 2023 Richard Lescak <rlescak@redhat.com> - 3.3.4-2
|
||||||
|
- add chained regex for rule 941310 to not match japan word 'company'
|
||||||
|
- Resolves: rhbz#2040257
|
||||||
|
|
||||||
* Thu Dec 08 2022 Luboš Uhliarik <luhliari@redhat.com> - 3.3.4-1
|
* Thu Dec 08 2022 Luboš Uhliarik <luhliari@redhat.com> - 3.3.4-1
|
||||||
- new version 3.3.4
|
- new version 3.3.4
|
||||||
- Resolves: #2141432 - [RFE] upgrade mod_security_crs to latest upstream 3.3.x
|
- Resolves: #2141432 - [RFE] upgrade mod_security_crs to latest upstream 3.3.x
|
||||||
|
|
Loading…
Reference in New Issue