CVE catalog

CVE-2019-11390

modsecurity-crs: CVE-2019-11390

[CVE catalog]

Severity
Low
Published
Source
[NVD] · [CVE record]
EPSS
1.63% · Oct 25, 2026

An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf allows remote attackers to cause a denial of service (ReDOS) by entering a specially crafted string with set_error_handler# at the beginning and nested repetition operators. NOTE: the software maintainer disputes that this is a vulnerability because the issue cannot be exploited via ModSecurity

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianmodsecurity-crssid3.3.9-1vulnerable
Debianmodsecurity-crsforky3.3.9-1vulnerable
Debianmodsecurity-crstrixie3.3.7-1+deb13u2vulnerable
Debianmodsecurity-crstrixie-security3.3.7-1+deb13u1vulnerable
Debianmodsecurity-crsbookworm3.3.4-1+deb12u3vulnerable
Debianmodsecurity-crsbookworm-security3.3.4-1+deb12u1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianmodsecurity-crssourcesid(unfixed)unimportantNot reported[928053]
Debianmodsecurity-crssourceforky(unfixed)unimportantNot reported[928053]
Debianmodsecurity-crssourcetrixie(unfixed)unimportantNot reported[928053]
Debianmodsecurity-crssourcebookworm(unfixed)unimportantNot reported[928053]

[Debian bug #928053]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [modsecurity-crs]Unknown
    Details (4)

    • 3.3.4-1+deb12u3 · all · bookworm

      Affected

      dsa · modsecurity-crs · debian · bookworm; dsa · modsecurity-crs · debian · 12

    • 3.3.4-1+deb12u3 · all · bookworm

      Affected

      dsa · modsecurity-crs · debian · bookworm; dsa · modsecurity-crs · debian · 12

    • 3.3.4-1+deb12u1 · all · bookworm-security

      Affected

      dsa · modsecurity-crs · debian · bookworm; dsa · modsecurity-crs · debian · 12

    • 3.3.4-1+deb12u1 · all · bookworm-security

      Affected

      dsa · modsecurity-crs · debian · bookworm; dsa · modsecurity-crs · debian · 12

[Debian 13 (Trixie)]

  • [modsecurity-crs]Unknown
    Details (4)

    • 3.3.7-1+deb13u2 · all · trixie

      Affected

      dsa · modsecurity-crs · debian · 13

    • 3.3.7-1+deb13u2 · all · trixie

      Affected

      dsa · modsecurity-crs · debian · 13

    • 3.3.7-1+deb13u1 · all · trixie-security

      Affected

      dsa · modsecurity-crs · debian · 13

    • 3.3.7-1+deb13u1 · all · trixie-security

      Affected

      dsa · modsecurity-crs · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]