NGINX.COM
Web Server Load Balancing with NGINX Plus

[Editor – The NGINX ModSecurity WAF module for NGINX Plus officially went End-of-Sale as of April 1, 2022 and is transitioning to End-of-Life effective March 31, 2024. For more details, see F5 NGINX ModSecurity WAF Is Transitioning to End-of-Life on our blog.]

On 14 September 2020, the OWASP ModSecurity Core Rule Set (CRS) team published details of a vulnerability in ModSecurity. The vulnerability has been assigned the identifier CVE-2020-15598, but details have not been published as of this writing. The nature of the issue is disputed by Trustwave, the maintainer of the ModSecurity project, who has proposed mitigations for the problematic behavior.

The issue can affect the NGINX ModSecurity WAF module for NGINX Plus, which is based on the current ModSecurity 3.0.4 release. The NGINX team at F5 worked with the reporter and has validated and applied their recommended update to recent releases of NGINX ModSecurity WAF (for NGINX Plus R20, R21, and R22).

For more details on the issue, please refer to the following resources:

The NGINX product team at F5 is grateful to Christian Folini at NetNEA and CRS developer Ervin Hegedüs for their support to create a patch for NGINX ModSecurity WAF. We strongly encourage NGINX Plus subscribers to upgrade their NGINX ModSecurity WAF module to the latest version for NGINX Plus R20, R21, or R22.

Subscribers who are running versions 20-1.0.0-12, 21-1.0.1-2, or 22-1.0.1-2 or later of the nginx-plus-module-modsecurity package are protected from this issue. To confirm the installed version, you can run the following command:

  • Ubuntu and related platforms:

  • # apt list --installed nginx-plus-module-modsecurity
    Listing... Done
    nginx-plus-module-modsecurity/stable,now 22+1.0.1-2~focal amd64 [installed]
  • Red Hat Enterprise Linux and related platforms:

    # yum list --installed nginx-plus-module-modsecurity
    nginx-plus-module-modsecurity.x86_64  22+1.0.1-2.el8.ngx    @nginx-plus

Please reach out to your NGINX support representative at F5 if you require any assistance.

If using a private, open source build of ModSecurity, refer to the official Trustwave SpiderLabs ModSecurity repository on GitHub, consider the alternative mitigations proposed by Trustwave, and evaluate the patch provided by the OWASP CRS team. If you use ModSecurity from another source, please contact the maintainer of that source or consider the mitigations described by the OWASP CRS team and TrustWave.

[The NGINX ModSecurity WAF module for NGINX Plus officially went End-of-Sale as of April 1, 2022 and is transitioning to End-of-Life effective March 31, 2024. For more details, see F5 NGINX ModSecurity WAF Is Transitioning to End-of-Life on our blog.]

Hero image

Learn how to deploy, configure, manage, secure, and monitor your Kubernetes Ingress controller with NGINX to deliver apps and APIs on-premises and in the cloud.



About The Author

Owen Garrett

Sr. Director, Product Management

Owen is a senior member of the NGINX Product Management team, covering open source and commercial NGINX products. He holds a particular responsibility for microservices and Kubernetes‑centric solutions. He’s constantly amazed by the ingenuity of NGINX users and still learns of new ways to use NGINX with every discussion.

About F5 NGINX

F5, Inc. is the company behind NGINX, the popular open source project. We offer a suite of technologies for developing and delivering modern applications. Together with F5, our combined solution bridges the gap between NetOps and DevOps, with multi-cloud application services that span from code to customer.

Learn more at nginx.com or join the conversation by following @nginx on Twitter.