hash algorithm collision

[Clockwork]

http://www.ocert.org/advisories/ocert-2011-003.html

Is lsws affected by this?

 

[webizen]

this affects php, java application not lsws itself.

 

[Clockwork]

is there a lsws setting to limit post vars somehow? Something like max_vars in suhosin.

 

[mistwang]

Modsecurity rule like

SecRule &ARGS "@gt 1000"

could do it.

 

[Clockwork]

great, can I use this line in the lsws request filter? or is there another syntax?

 

[webizen]

yes, you can with the same syntax.