https://access.redhat.com/node/1200223
If you're affected, mod_security is the best way to stop this right now.
If you're not using mod_security, iptables can protect you a little better than doing nothing.
iptables -I INPUT -m string --hex-string '|28 29 20 7B|' --algo bm -j DROP