Skip to content

Commit 5a9e41c

Browse files
fzipiEsadCetiner
fzipi
and
EsadCetiner
authored
chore: release v4.19.0 (#4276)
* chore: release v4.19.0 Signed-off-by: Felipe Zipitria <felipe.zipitria@owasp.org> * Update CONTRIBUTORS.md Co-authored-by: Esad Cetiner <104706115+EsadCetiner@users.noreply.github.com> --------- Signed-off-by: Felipe Zipitria <felipe.zipitria@owasp.org> Co-authored-by: Esad Cetiner <104706115+EsadCetiner@users.noreply.github.com>
1 parent a1f5e14 commit 5a9e41c

32 files changed

+698
-672
lines changed

‎CHANGES.md‎

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,31 @@
55
or the CRS Google Group at
66
* https://groups.google.com/a/owasp.org/g/modsecurity-core-rule-set-project
77

8-
## Version 4.18.0-dev - 2025-MM-DD
8+
## Version 4.20.0-dev - 2025-MM-DD
9+
10+
## Version 4.19.0 - 2025-10-02
11+
12+
## What's Changed
13+
### ⭐ Important changes
14+
* refactor: 920340 - delete 920341 by @touchweb-vincent in https://github.com/coreruleset/coreruleset/pull/4268
15+
### 🆕 New features and detections 🎉
16+
* fix: update lfi-os-files.data by @Xhoenix in https://github.com/coreruleset/coreruleset/pull/4240
17+
### 🧰 Other Changes
18+
* fix: dont block `.url` file extension by @EsadCetiner in https://github.com/coreruleset/coreruleset/pull/4259
19+
* fix(933135): wrong score variable by @touchweb-vincent in https://github.com/coreruleset/coreruleset/pull/4262
20+
* fix(933153): missing inbound_anomaly_score by @touchweb-vincent in https://github.com/coreruleset/coreruleset/pull/4260
21+
* fix(953100): remove generic SQLSTATE error codes causing false positives by @Elnadrion in https://github.com/coreruleset/coreruleset/pull/4257
22+
* feat: add stricter sibling 954101 to 954100 by @franbuehler in https://github.com/coreruleset/coreruleset/pull/4258
23+
* fix(942550): cleanup regex by @fzipi in https://github.com/coreruleset/coreruleset/pull/3767
24+
* fix: reduce false positives with php response rules by @EsadCetiner in https://github.com/coreruleset/coreruleset/pull/4272
25+
* fix: don't block on all question marks (942550 PL-1) by @EsadCetiner in https://github.com/coreruleset/coreruleset/pull/4264
26+
* feat: whitelist application/csp-report content-type header by @Elnadrion in https://github.com/coreruleset/coreruleset/pull/4274
27+
28+
## New Contributors
29+
* @touchweb-vincent made their first contribution in https://github.com/coreruleset/coreruleset/pull/4262
30+
* @Elnadrion made their first contribution in https://github.com/coreruleset/coreruleset/pull/4257
31+
32+
**Full Changelog**: https://github.com/coreruleset/coreruleset/compare/v4.18.0...v4.19.0
933

1034
## Version 4.18.0 - 2025-09-03
1135

‎CONTRIBUTORS.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,8 @@
3030

3131
## Contributors:
3232

33+
- [touchweb-vincent](https://github.com/touchweb-vincent)
34+
- [Elnadrion](https://github.com/Elnadrion)
3335
- [pha6d](https://github.com/pha6d)
3436
- [KIC-8462852](https://github.com/KIC-8462852)
3537
- [Muhammad Ayman](https://github.com/TheRubick)

‎SECURITY.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,8 @@ Along those lines, OWASP CRS team may not issue security notifications for unsup
1111

1212
| Version | Supported |
1313
| --------- | ------------------ |
14+
| 4.19.z | :white_check_mark: |
1415
| 4.18.z | :white_check_mark: |
15-
| 4.17.z | :white_check_mark: |
1616
| 4.y.z | :x: |
1717
| 3.3.x | :white_check_mark: |
1818
| 3.2.x | :x: |

‎crs-setup.conf.example‎

Lines changed: 27 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# ------------------------------------------------------------------------
2-
# OWASP CRS ver.4.19.0-dev
2+
# OWASP CRS ver.4.19.0
33
# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
44
# Copyright (c) 2021-2025 CRS project. All rights reserved.
55
#
@@ -181,7 +181,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
181181
# t:none,\
182182
# nolog,\
183183
# tag:'OWASP_CRS',\
184-
# ver:'OWASP_CRS/4.19.0-dev',\
184+
# ver:'OWASP_CRS/4.19.0',\
185185
# setvar:tx.blocking_paranoia_level=1"
186186

187187

@@ -209,7 +209,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
209209
# t:none,\
210210
# nolog,\
211211
# tag:'OWASP_CRS',\
212-
# ver:'OWASP_CRS/4.19.0-dev',\
212+
# ver:'OWASP_CRS/4.19.0',\
213213
# setvar:tx.detection_paranoia_level=1"
214214

215215

@@ -235,7 +235,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
235235
# t:none,\
236236
# nolog,\
237237
# tag:'OWASP_CRS',\
238-
# ver:'OWASP_CRS/4.19.0-dev',\
238+
# ver:'OWASP_CRS/4.19.0',\
239239
# setvar:tx.enforce_bodyproc_urlencoded=1"
240240

241241

@@ -270,7 +270,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
270270
# t:none,\
271271
# nolog,\
272272
# tag:'OWASP_CRS',\
273-
# ver:'OWASP_CRS/4.19.0-dev',\
273+
# ver:'OWASP_CRS/4.19.0',\
274274
# setvar:tx.critical_anomaly_score=5,\
275275
# setvar:tx.error_anomaly_score=4,\
276276
# setvar:tx.warning_anomaly_score=3,\
@@ -324,7 +324,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
324324
# t:none,\
325325
# nolog,\
326326
# tag:'OWASP_CRS',\
327-
# ver:'OWASP_CRS/4.19.0-dev',\
327+
# ver:'OWASP_CRS/4.19.0',\
328328
# setvar:tx.inbound_anomaly_score_threshold=5,\
329329
# setvar:tx.outbound_anomaly_score_threshold=4"
330330

@@ -385,7 +385,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
385385
# t:none,\
386386
# nolog,\
387387
# tag:'OWASP_CRS',\
388-
# ver:'OWASP_CRS/4.19.0-dev',\
388+
# ver:'OWASP_CRS/4.19.0',\
389389
# setvar:tx.reporting_level=4"
390390

391391

@@ -417,7 +417,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
417417
# t:none,\
418418
# nolog,\
419419
# tag:'OWASP_CRS',\
420-
# ver:'OWASP_CRS/4.19.0-dev',\
420+
# ver:'OWASP_CRS/4.19.0',\
421421
# setvar:tx.early_blocking=1"
422422

423423

@@ -438,7 +438,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
438438
# t:none,\
439439
# nolog,\
440440
# tag:'OWASP_CRS',\
441-
# ver:'OWASP_CRS/4.19.0-dev',\
441+
# ver:'OWASP_CRS/4.19.0',\
442442
# setvar:tx.enable_default_collections=1"
443443

444444

@@ -476,7 +476,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
476476
# t:none,\
477477
# nolog,\
478478
# tag:'OWASP_CRS',\
479-
# ver:'OWASP_CRS/4.19.0-dev',\
479+
# ver:'OWASP_CRS/4.19.0',\
480480
# setvar:'tx.allowed_methods=GET HEAD POST OPTIONS'"
481481

482482
# Content-Types that a client is allowed to send in a request.
@@ -516,7 +516,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
516516
# t:none,\
517517
# nolog,\
518518
# tag:'OWASP_CRS',\
519-
# ver:'OWASP_CRS/4.19.0-dev',\
519+
# ver:'OWASP_CRS/4.19.0',\
520520
# chain"
521521
# SecRule REQUEST_URI "@rx ^/foo/bar" \
522522
# "t:none,\
@@ -535,7 +535,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
535535
# t:none,\
536536
# nolog,\
537537
# tag:'OWASP_CRS',\
538-
# ver:'OWASP_CRS/4.19.0-dev',\
538+
# ver:'OWASP_CRS/4.19.0',\
539539
# setvar:'tx.allowed_request_content_type=|application/x-www-form-urlencoded| |multipart/form-data| |text/xml| |application/xml| |application/soap+xml| |application/json| |application/reports+json| |application/csp-report|'"
540540

541541
# Allowed HTTP versions.
@@ -551,7 +551,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
551551
# t:none,\
552552
# nolog,\
553553
# tag:'OWASP_CRS',\
554-
# ver:'OWASP_CRS/4.19.0-dev',\
554+
# ver:'OWASP_CRS/4.19.0',\
555555
# setvar:'tx.allowed_http_versions=HTTP/1.0 HTTP/1.1 HTTP/2 HTTP/2.0 HTTP/3 HTTP/3.0'"
556556

557557
# Forbidden file extensions.
@@ -575,7 +575,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
575575
# t:none,\
576576
# nolog,\
577577
# tag:'OWASP_CRS',\
578-
# ver:'OWASP_CRS/4.19.0-dev',\
578+
# ver:'OWASP_CRS/4.19.0',\
579579
# setvar:'tx.restricted_extensions=.ani/ .asa/ .asax/ .ascx/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .compositefont/ .config/ .conf/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .drv/ .gadget/ .hta/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .inf/ .ini/ .jse/ .key/ .licx/ .lnk/ .log/ .mdb/ .msc/ .ocx/ .old/ .pass/ .pdb/ .pfx/ .pif/ .pem/ .pol/ .prf/ .printer/ .pwd/ .rdb/ .rdp/ .reg/ .resources/ .resx/ .scr/ .sct/ .shs/ .sql/ .swp/ .sys/ .tlb/ .tmp/ .vb/ .vbe/ .vbs/ .vbproj/ .vsdisco/ .vxd/ .webinfo/ .ws/ .wsc/ .wsf/ .wsh/ .xsd/ .xsx/'"
580580

581581
# Restricted request headers.
@@ -623,7 +623,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
623623
# t:none,\
624624
# nolog,\
625625
# tag:'OWASP_CRS',\
626-
# ver:'OWASP_CRS/4.19.0-dev',\
626+
# ver:'OWASP_CRS/4.19.0',\
627627
# setvar:'tx.restricted_headers_basic=/content-encoding/ /proxy/ /lock-token/ /content-range/ /if/ /x-http-method-override/ /x-http-method/ /x-method-override/ /x-middleware-subrequest/'"
628628
#
629629
# [ Extended ]
@@ -649,7 +649,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
649649
# t:none,\
650650
# nolog,\
651651
# tag:'OWASP_CRS',\
652-
# ver:'OWASP_CRS/4.19.0-dev',\
652+
# ver:'OWASP_CRS/4.19.0',\
653653
# setvar:'tx.restricted_headers_extended=/accept-charset/'"
654654

655655
# Content-Types charsets that a client is allowed to send in a request.
@@ -668,7 +668,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
668668
# t:none,\
669669
# nolog,\
670670
# tag:'OWASP_CRS',\
671-
# ver:'OWASP_CRS/4.19.0-dev',\
671+
# ver:'OWASP_CRS/4.19.0',\
672672
# setvar:'tx.allowed_request_content_type_charset=|utf-8| |iso-8859-1| |iso-8859-15| |windows-1252|'"
673673

674674
#
@@ -694,7 +694,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
694694
# t:none,\
695695
# nolog,\
696696
# tag:'OWASP_CRS',\
697-
# ver:'OWASP_CRS/4.19.0-dev',\
697+
# ver:'OWASP_CRS/4.19.0',\
698698
# setvar:tx.max_num_args=255"
699699

700700
# Block request if the length of any argument name is too high
@@ -708,7 +708,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
708708
# t:none,\
709709
# nolog,\
710710
# tag:'OWASP_CRS',\
711-
# ver:'OWASP_CRS/4.19.0-dev',\
711+
# ver:'OWASP_CRS/4.19.0',\
712712
# setvar:tx.arg_name_length=100"
713713

714714
# Block request if the length of any argument value is too high
@@ -722,7 +722,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
722722
# t:none,\
723723
# nolog,\
724724
# tag:'OWASP_CRS',\
725-
# ver:'OWASP_CRS/4.19.0-dev',\
725+
# ver:'OWASP_CRS/4.19.0',\
726726
# setvar:tx.arg_length=400"
727727

728728
# Block request if the total length of all combined arguments is too high
@@ -736,7 +736,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
736736
# t:none,\
737737
# nolog,\
738738
# tag:'OWASP_CRS',\
739-
# ver:'OWASP_CRS/4.19.0-dev',\
739+
# ver:'OWASP_CRS/4.19.0',\
740740
# setvar:tx.total_arg_length=64000"
741741

742742
# Block request if the file size of any individual uploaded file is too high
@@ -750,7 +750,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
750750
# t:none,\
751751
# nolog,\
752752
# tag:'OWASP_CRS',\
753-
# ver:'OWASP_CRS/4.19.0-dev',\
753+
# ver:'OWASP_CRS/4.19.0',\
754754
# setvar:tx.max_file_size=1048576"
755755

756756
# Block request if the total size of all combined uploaded files is too high
@@ -764,7 +764,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
764764
# t:none,\
765765
# nolog,\
766766
# tag:'OWASP_CRS',\
767-
# ver:'OWASP_CRS/4.19.0-dev',\
767+
# ver:'OWASP_CRS/4.19.0',\
768768
# setvar:tx.combined_file_sizes=1048576"
769769

770770

@@ -804,7 +804,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
804804
# pass,\
805805
# nolog,\
806806
# tag:'OWASP_CRS',\
807-
# ver:'OWASP_CRS/4.19.0-dev',\
807+
# ver:'OWASP_CRS/4.19.0',\
808808
# setvar:tx.sampling_percentage=100"
809809

810810

@@ -825,7 +825,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
825825
# t:none,\
826826
# nolog,\
827827
# tag:'OWASP_CRS',\
828-
# ver:'OWASP_CRS/4.19.0-dev',\
828+
# ver:'OWASP_CRS/4.19.0',\
829829
# setvar:tx.crs_validate_utf8_encoding=1"
830830

831831
# -- [[ Skip Checking Responses ]] ------------------------------------------------
@@ -847,7 +847,7 @@ SecDefaultAction "phase:2,log,auditlog,pass"
847847
# t:none,\
848848
# nolog,\
849849
# tag:'OWASP_CRS',\
850-
# ver:'OWASP_CRS/4.19.0-dev',\
850+
# ver:'OWASP_CRS/4.19.0',\
851851
# setvar:tx.crs_skip_response_analysis=1"
852852

853853
#
@@ -868,5 +868,5 @@ SecAction \
868868
t:none,\
869869
nolog,\
870870
tag:'OWASP_CRS',\
871-
ver:'OWASP_CRS/4.19.0-dev',\
871+
ver:'OWASP_CRS/4.19.0',\
872872
setvar:tx.crs_setup_version=4190"

‎rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf.example‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# ------------------------------------------------------------------------
2-
# OWASP CRS ver.4.19.0-dev
2+
# OWASP CRS ver.4.19.0
33
# Copyright (c) 2006-2020 Trustwave and contributors. All rights reserved.
44
# Copyright (c) 2021-2025 CRS project. All rights reserved.
55
#

0 commit comments

Comments
 (0)