title	layout	tab	order	tags
News	col-sidebar	true	1	example-tag

News From the OWASP ModSecurity Project

The following is a lose collection of news and status reports since OWASP took over the project in Jan 2024.

We had more discussions about code, bug reports and improvements. Given we are seeking to build a new development company, this is a very good sign and deserves the top priority.
With 3 open source SecLang implementations (ModSec v2, ModSec v3, Coraza), there is a growing need to coordinate the behavior, namely with implementation differences and new features. OWASP ModSecurity has proposed a SecLang round table and invited several stakeholders (Coraza and several rules projects) to discuss a pending problem. This meeting will happen in the coming weeks.
Original author of ModSecurity, Ivan Ristić, presented at the OWASP London 20 years anniversary event about 22 years of ModSecurity. Link to video

We had to roll back several commits on v2. This brought us to the conclusion we need CI/CD in place before we merge anything.
So Ervin has set up a minimal CI/CD environment and development picked up again.
We have established minimal review process that involves either Marc or Ervin signing off any pull request before merging for the time being.
Technical discussions with more participants have started on Slack and on Github. Apparently a good sign.
Christian did a presentation around OWASP ModSecurity, history, status, plans and an OWASP perspective for OWASP Netherlands. Recording will be published soon.
OWASP CRS has released CRS 4. This includes a plugin functionality but more importantly for ModSecurity, it no longer depends on PCRE.

The first release under new management: 3.0.12. Given Trustwave handed over the repo with the fix for CVE-2024-1019 scheduled but not released, we had to get going very fast.
The day after the release, a blog post went up that explains a different behavior in v2 and v3. It is in an area close to the CVE we fixed. We'll have to sort this out.
ModSecurity development has started again and Marc has merged a few PRs that have been open for quite some time. One of them addressed longstanding problem with t:cmdLine (PR 3051).
More talks with commercial integrators.

Trustwave has transferred the ModSecurity repo to https://github.com/owasp-modsecurity/ModSecurity.
The OWASP.org page at https://owasp.org/www-project-modsecurity/ has been launched.
OWASP has confirmed the new intermediary leadership team: Ervin Hegedüs, Marc Stern and Christian Folini. A portrait of them is on the owasp.org page of the project.
The OWASP project committee has promoted OWASP ModSecurity to production level. While this is only an administrative status, there is symbolic value in the promotion.
Trustwave has handed over the Twitter (X) account to OWASP. Ervin and Christian are delegates on the account.
Trustwave did not release the previously announced security fix for ModSecurity3. Instead, they have asked OWASP ModSecurity execute the release with their assistance. We are now aiming for Jan 29 / 30. (this came a bit out of the blue for us)
Contact with an additional ModSecurity integrator established.

Trustwave has shared the patch for the upcoming ModSecurity3 security release with Ervin. He tested it and it looks good. Expect a release on Monday.
We got two additional endorsements. More are promised and I might ping again.
There is a vendor who runs ModSec3 with Apache. My contact is currently out skiing but he promised to call me after his return.
Contact with OWASP project committee established.
Ivan Ristić shared the trademark identifier for ModSecurity with us. The trademark is currently with Trustwave and OWASP will make sure it's transferred too.
We're still waiting to get the github repo to setup an initial OWASP project page via https://github.com/owasp/project-modsecurity (does not exist yet). We're getting there, I'm sure.
We have started to collect a list of ModSecurity vendors and integrators. Two people volunteered to do more research. If you are also able to contribute, then please get in touch.

Talked to 7 people / industry leaders about an endorsement of OWASP ModSecurity
- Ofer Shezaf promised to write an endorsement on LinkedIn
- Ryan Barnett tells me to use his twitter statement
Addressed community via existing communication channels:
- Trustwave Spiderlabs Blog
- OWASP Blog
- ModSecurity Mailinglists
- Various social media accounts on Twitter / X as well as LinkedIn
- Christian Folini's ModSecurity / CRS newsletter sent to 1950 addresses
- The only thing missing is a tweet by the @ModSecurity twitter account
Lined up a first podcast appearance, but it will be February or March
Contact with OWASP project committee initiated (we know the process to become a flagship project now), but no real feedback so far
We're making progress with forming a temporary leader team for the project (The idea is to run with a self-appointed leader team during the incubation phase and then let the community form a production leader team in Spring)
#project-modsecurity channel on Slack established
Apparently development has not really started, but ModSec3 is planned to get a security release on Jan 22 (bookmark that date, it has at least a medium severity) and Trustwave has asked OWASP to cooperate on that release.
Got in touch with a commercial integrator who runs their own libModSecurity3-Apache connector. The question will be if they would be interested to donate the code. Potentially a short cut to get a production hardened Apache connector.

Trustwave Transfers ModSecurity Custodianship to the Open Worldwide Application Security Project (OWASP)
Trustwave Transfers ModSecurity Custodianship to OWASP

Provide feedback