It was discovered that one of the rules in the OWASP ModSecurity Core Rule Set parsed some multipart requests incorrectly.
https://security-tracker.debian.org/tracker/DSA-6105-1
Continue reading...
https://security-tracker.debian.org/tracker/DSA-6105-1
Continue reading...

