Описание
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Su...
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 1.30.4-5ubuntu1 |
| esm-infra-legacy/trusty | released | 1.4.6-1ubuntu3.9+esm9 |
| esm-infra-legacy/xenial | released | 1.10.3-0ubuntu0.16.04.5+esm10 |
| esm-infra/bionic | released | 1.14.0-0ubuntu1.11+esm5 |
| esm-infra/focal | released | 1.18.0-0ubuntu1.7+esm4 |
| jammy | released | 1.18.0-6ubuntu14.21 |
| noble | released | 1.24.0-2ubuntu7.18 |
| resolute | released | 1.28.3-2ubuntu1.11 |
| stonking | not-affected | 1.30.4-5ubuntu1 |
| upstream | released | 1.31.3,1.30.4 |
Показывать по
Ссылки на источники
EPSS
8.1 High
CVSS3
Связанные уязвимости
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical ...
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technica
A vulnerability exists in NGINX Plus and NGINX Open Source when a mapd ...
EPSS
8.1 High
CVSS3