We recently released ModSecurity version 2.9.2. The release contains a number of bug fixes, including two security issues:
Among the fixes we have an important update of libInjection, to get ahead of some known bypasses to the library, some fixes and improvements to the handling of collections, a fix for SecHashEngine to correctly rewrite hrefs and a fix to the IIS version related to IPv4 addresses not being correctly parsed.
As for new features there is a now a number of compile time options to {dis|en}able some logging data, an optional lock for collection manipulation. The IIS build and scripts were also refactored to update dependencies to their latest and safest releases and also allow users to easily build their own versions.
This release, like all releases of 2.9 family, is a combined release for all bindings/versions that we support: Apache, Nginx, and IIS. Although Nginx users preferably want to use libModSecurity with the ModSecurity-nginx connector.
This is likely the last release of 2.9.2 family to have new features since this version is being slowly deprecated in favor of ModSecurity version 3.
We've received a lot of positive feedback from the community and suggest that everyone take time to update to this latest release. Also don't forget to provide feedback over GitHub or the mailing lists.
A complete list of changes from 2.9.1 to 2.9.2 is available here: https://github.com/SpiderLabs/ModSecurity/releases
The source and binaries (and the respective hashes) are available at: https://github.com/SpiderLabs/ModSecurity/releases/tag/v2.9.2
Thanks to everybody who participates with bug reports, comments, and code, including:
@victorhora, @defanator, @client9, @bjdijk, @hideaki, @parthasarathi204, Daniel Stelter-Gliese, @LukeP21, @mturk, Coty Sutherland, Robert Bost, Marc Stern, @bazzadp, Sander Hoentjen, Robert Paprocki, @Rendername, @emphazer, Chaim Sanders, Thomas Deutschmann, Michael Kjeldsen, Armin Abfalterer, Robert Culyer, Ephraim Vider, @charlymps, Christian Folini, Alexey Sintsov.