CVSS 7.8 · High EPSS 0,34%
Kerentanan Out-of-bounds Read pada f5 nginx plus, f5 nginx open source. Skor CVSS 3.1 7.8 (High) menurut f5.com.
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX worker memory resulting in its termination or possibly code execution, using a specially crafted MP4 file. This issue affects NGINX Open Source and NGINX Plus if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted MP4 file with the ngx_http_mp4_module module. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| f5 | nginx plus | Versi r32 p1 |
| f5 | nginx plus | Versi r32 p2 |
| f5 | nginx plus | Versi r32 p3 |
| f5 | nginx plus | Versi r32 p4 |
| f5 | nginx plus | Versi r33 |
| f5 | nginx plus | Versi r33 p1 |
| f5 | nginx plus | Versi r33 p2 |
| f5 | nginx plus | Versi r33 p3 |
| f5 | nginx plus | Versi r34 |
| f5 | nginx plus | Versi r34 p1 |
| f5 | nginx plus | Versi r34 p2 |
| f5 | nginx plus | Versi r35 |
| f5 | nginx plus | Versi r35 p1 |
| f5 | nginx plus | Versi r36 |
| f5 | nginx plus | Versi r36 p1 |
| f5 | nginx plus | Versi r36 p2 |
| f5 | nginx open source | Versi 1.1.19 hingga sebelum 1.28.3 |
| f5 | nginx open source | Versi 1.29.0 hingga sebelum 1.29.7 |