SB20250711189 - openEuler 24.03 LTS SP2 update for mod_security

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Resource exhaustion (CVE-ID: CVE-2025-48866)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources within the sanitiseArg action. A remote attacker can send an HTTP request containing a large number of arguments, trigger resource exhaustion and perform a denial of service (DoS) attack.

2) Buffer overflow (CVE-ID: CVE-2025-52891)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when processing XML data with an empty XML tag. A remote attacker can send specially crafted XML data to the web application protected with ModSecurity, trigger memory corruption and perform a denial of service (DoS) attack.

Note, the vulnerability affects installations with SecParseXmlIntoArgs set to "On" or "OnlyArgs", which is not the default configuration. 

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1750