Availability of ModSecurity 2.7.4: Nginx Stable Release
Important Security Fix - There is a security issue fixed with this release, please check CVE-2013-2765 for more information. Upgrading is high recommended.
We also added support for the libinjection library as a new operator called @detectSQLi. I will be doing a separate blog post on libinjection as it deserves more attention.
Please see the release notes included in the CHANGES file. For known problems and more information about bug fixes, please see the ModSecurity Jira. You can optionally report any bug to mod-security-developers@lists.sourceforge.net.
Google Summer of Code Participation
OWASP is again participating Organization in Google's Summer of Code (GSoC) program which provides stipends to student developers to write code for approved open source projects. I am excited to announce that one of OWASP's GSoC slots was awarded to Mihai Pitu who will be working on a Java port of ModSecurity! Here is the ABSTRACT:
The goal of this GSOC project is to have a ModSecurity version that can be used within Java servers (e.g. Tomcat). In order to achieve this, the standalone C code will be wrapped using the JNI framework and the resulting ModSecurity Java project will be used as a module for Tomcat server. Also, we will collaborate with the OWASP WebGoat team in order to integrate ModSecurity for Java into it.
Mihai's complete submission is here. The main problem this project solves is that you will no longer have to front-end your Java app servers with a reverse proxy in order to gain ModSecurity protections! ModSecurity standalone code will use JNI to hook into Java servers (Tomcat, Spring, Stuts, etc...) as a Servlet Filter.
If you want to follow along with our GSoC development over the summer, you can check out Mihai's GitHub repo.
