Monitor this situation.
Unsubscribe anytime.
[SITUATION] · [QUIET] · [TECHNOLOGY]
2 clusters · 3 sources · 5 days · First seen · Last updated
NGINX security vulnerability disclosures
Overview
F5 disclosed several security vulnerabilities affecting both NGINX Plus and NGINX Open Source, prompting the release of urgent patches for the mainline (1.31.7) and stable (1.30.6) branches. The flaws include memory-related issues such as a use-after-free vulnerability in the ngx_http_core_module and a heap buffer overflow involving alias, rewrite, and set/return directives. Some of these vulnerabilities reportedly date back to 2009.
While the NGINX project rated the flaws as ‘medium’ severity, F5 assigned a CVSS v4.0 score of 9.2 (Critical) to three of the memory-related bugs, which could potentially lead to worker process crashes or remote code execution. Additional vulnerabilities include a non-deterministic TLS session forgery that could allow attackers to bypass client-certificate checks, and an issue affecting HTTP/3 clients. As of mid-October, there have been no reports of these vulnerabilities being exploited in the wild.
Entities
Timeline
-
[TECHNOLOGY] 2 sourcesNGINX releases patches for five security vulnerabilities
NGINX released patches for five vulnerabilities, including three memory bugs that F5 rates as critical with a CVSS score of 9.2. The flaws require specific configurations to be exploited.
-
[TECHNOLOGY] 2 sourcesNGINX releases security patches for multiple vulnerabilities
F5 has released security patches for NGINX mainline and stable branches to address multiple vulnerabilities, including flaws dating back to 2009 that could allow remote attackers to crash servers.
Sources
blogspan.net · cybernoz.com · linuxcompatible.org