CVE-2021-23017

f5 nginx, openresty, fedoraproject fedora +10 lainnya

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2021-23017

Katalog CVE

CVSS 7.7 · High EPSS 53,5%

Kerentanan Off-by-one Error pada f5 nginx, openresty +11 lainnya. Skor CVSS 3.1 7.7 (High) menurut NVD.

Deskripsi (NVD)

A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.

Rincian

Terbit di NVD
1 Juni 2021
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
7.7 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-193: Off-by-one Error
EPSS (30 hari)
53,5% peluang dieksploitasi; lebih tinggi dari 98,9% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
f5 nginx Versi 0.6.18 hingga sebelum 1.20.1
openresty openresty Semua versi sebelum 1.19.3.2
fedoraproject fedora Versi 33
fedoraproject fedora Versi 34
netapp ontap select deploy administration utility Semua versi
oracle blockchain platform Semua versi sebelum 21.1.2
oracle communications control plane monitor Versi 3.4
oracle communications control plane monitor Versi 4.2
oracle communications control plane monitor Versi 4.3
oracle communications control plane monitor Versi 4.4
oracle communications fraud monitor Versi 3.4 hingga 4.4
oracle communications operations monitor Versi 3.4
oracle communications operations monitor Versi 4.2
oracle communications operations monitor Versi 4.3
oracle communications operations monitor Versi 4.4
oracle communications session border controller Versi 8.4
oracle communications session border controller Versi 9.0
oracle enterprise communications broker Versi 3.3.0
oracle enterprise session border controller Versi 8.4
oracle enterprise session border controller Versi 9.0
oracle enterprise telephony fraud monitor Versi 3.4
oracle enterprise telephony fraud monitor Versi 4.2
oracle enterprise telephony fraud monitor Versi 4.3
oracle enterprise telephony fraud monitor Versi 4.4
oracle goldengate Semua versi sebelum 21.4.0.0.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.