ModSecurity, Regular Expressions and Disputed CVE-2020-15598

[zimmerle]

There is a dispute around the CVE-2020-15598.

OWASP CRS made their claims here: https://coreruleset.org/20200914/cve-2020-15598/

ModSecurity position is detailed here: https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-regular-expressions-and-disputed-cve-2020-15598/

[martinhsv]

This issue refers to the /g emulation that was in place for the rx operator in versions 3.0.0-3.0.4. Since the change of behaviour to single-match-then-exit has been in place since v3.0.5, there would not seem to be any value in keeping this item open any longer.