Описание
An issue in OpenResty lua-nginx-module v.0.10.26 and before allows a remote attacker to conduct HTTP request smuggling via a crafted HEAD request.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| libnginx-mod-http-lua | fixed | 1:0.10.27-1 | package | |
| libnginx-mod-http-lua | fixed | 1:0.10.23-1+deb12u1 | bookworm | package |
| nginx | fixed | 1.22.0-3 | package |
Примечания
src:nginx/1.22.0-3 removed the http-lua module and moved it to a separate package
https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn
https://www.benasin.space/2025/03/18/OpenResty-lua-nginx-module-v0-10-26-HTTP-Request-Smuggling-in-HEAD-requests/
https://github.com/openresty/lua-nginx-module/commit/e5248aa8203d3e0075822a577c1cdd19f5f1f831 (v0.10.27rc1)
Связанные уязвимости
An issue in OpenResty lua-nginx-module v.0.10.26 and before allows a remote attacker to conduct HTTP request smuggling via a crafted HEAD request.
An issue in OpenResty lua-nginx-module v.0.10.26 and before allows a remote attacker to conduct HTTP request smuggling via a crafted HEAD request.
An issue in OpenResty lua-nginx-module v.0.10.26 and before allows a remote attacker to conduct HTTP request smuggling via a crafted HEAD request.
An issue in OpenResty lua-nginx-module v.0.10.26 and before allows a remote attacker to conduct HTTP request smuggling via a crafted HEAD request.
Уязвимость модуля lua-nginx-module веб-сервера NGINX, связанная с непоследовательной интерпретацией HTTP-запросов, позволяющая нарушителю отправить скрытый HTTP-запрос (атака типа HTTP Request Smuggling)