Trustwave's 2024 Financial Services Threat Reports Highlight Alarming Trends in Insider Threats & Phishing-as-a-Service. Learn More
Get access to immediate incident response assistance.
Get access to immediate incident response assistance.
Trustwave's 2024 Financial Services Threat Reports Highlight Alarming Trends in Insider Threats & Phishing-as-a-Service. Learn More
The ModSecurity Development Team is pleased to announce the availability of ModSecurity 2.7.4 Stable Release. This release includes many bug fixes and the NGINX module version is now labled as STABLE.
Important Security Fix - There is a security issue fixed with this release, please check CVE-2013-2765 for more information. Upgrading is high recommended.
We also added support for the libinjection library as a new operator called @detectSQLi. I will be doing a separate blog post on libinjection as it deserves more attention.
Please see the release notes included in the CHANGES file. For known problems and more information about bug fixes, please see the ModSecurity Jira. You can optionally report any bug to mod-security-developers@lists.sourceforge.net.
OWASP is again participating Organization in Google's Summer of Code (GSoC) program which provides stipends to student developers to write code for approved open source projects. I am excited to announce that one of OWASP's GSoC slots was awarded to Mihai Pitu who will be working on a Java port of ModSecurity! Here is the ABSTRACT:
The goal of this GSOC project is to have a ModSecurity version that can be used within Java servers (e.g. Tomcat). In order to achieve this, the standalone C code will be wrapped using the JNI framework and the resulting ModSecurity Java project will be used as a module for Tomcat server. Also, we will collaborate with the OWASP WebGoat team in order to integrate ModSecurity for Java into it.
Mihai's complete submission is here. The main problem this project solves is that you will no longer have to front-end your Java app servers with a reverse proxy in order to gain ModSecurity protections! ModSecurity standalone code will use JNI to hook into Java servers (Tomcat, Spring, Stuts, etc...) as a Servlet Filter.
If you want to follow along with our GSoC development over the summer, you can check out Mihai's GitHub repo.
Trustwave is a globally recognized cybersecurity leader that reduces cyber risk and fortifies organizations against disruptive and damaging cyber threats. Our comprehensive offensive and defensive cybersecurity portfolio detects what others cannot, responds with greater speed and effectiveness, optimizes client investment, and improves security resilience. Learn more about us.
Copyright © 2024 Trustwave Holdings, Inc. All rights reserved.