Announcing ModSecurity versions 3.0.8 and 2.9.6

We are announcing the release of ModSecurity 3.0.8 (libModSecurity) and 2.9.6. These versions contain both new features and bug fixes.

Of note are some updates to request body parsing to prevent certain rule-bypass opportunities. Stay tuned. We are going to release some follow-up blog content providing more details of these items.

New features and security impacting issues

• Adjust parser activation rules in modsecurity.conf-recommended
  [@terjanq, @martinhsv]
• Multipart parsing fixes and new MULTIPART_PART_HEADERS collection
  [@terjanq, @martinhsv]

Bug fixes – v2

• Limit rsub null termination to where necessary
  [Issue #2794 - @marcstern, @martinhsv]
• IIS: Update dependencies for next planned release
  [@martinhsv]
• XML parser cleanup: NULL duplicate pointer
  [Issue #2760 - @martinhsv]
• Properly cleanup XML parser contexts upon completion
  [Issue #2239 - @argenet]
• Fix memory leak in streams
  [Issue #2208 - @marcstern, @vloup, @JamesColeman-LW]
• Fix: negative usec on log line when data type long is 32b
  [Issue #2753 - @ABrauer-CPT, @martinhsv]
• mlogc log-line parsing fails due to enhanced timestamp
  [Issue #2682 - @bozhinov, @ABrauer-CPT,@martinhsv]
• Allow no-key, single-value JSON body
  [Issue #2735 - @marcstern, @martinhsv]
• Set SecStatusEngine Off in modsecurity.conf-recommended
  [Issue #2717 - @un99known99, @martinhsv]
• Fix memory leak that occurs on JSON parsing error
  [Issue #2236 - @argenet, @vloup, @martinhsv]
• Multipart names/filenames may include single quote if double-quote enclosed
  [Issue #2352 - @martinhsv]
• Add SecRequestBodyJsonDepthLimit to modsecurity.conf-recommended
  [Issue #2647 - @theMiddleBlue, @airween, @877509395, @martinhsv]

Bug fixes – v3

• Prevent LMDB related segfault
  [Issue #2755, #2761 - @dvershinin]
• Fix msc_transaction_cleanup function comment typo
  [Issue #2788 - @lookat23]
• Fix: MULTIPART_INVALID_PART connected to wrong internal variable
  [Issue #2785 - @martinhsv]
• Restore Unique_id to include random portion after timestamp
  [Issue #2752, #2758 - @datkps11, @martinhsv]

Additional information on the releases, including the source and binaries (and hashes/signatures), is available at:

• https://github.com/SpiderLabs/ModSecurity/releases/tag/v3.0.8
• https://github.com/SpiderLabs/ModSecurity/releases/tag/v2.9.6

The list of open issues is available on GitHub: https://github.com/SpiderLabs/ModSecurity/issues

Thanks to everybody who helped in this process: reporting issues, making comments and suggestions, sending patches, etc.