Sign-up

ID

VAR-202210-1373


CVE

CVE-2022-41742


TITLE

F5 Networks  of  nginx  Out-of-Bounds Write Vulnerability in Other Vendors' Products

Trust: 0.8

sources: JVNDB: JVNDB-2022-022651

DESCRIPTION

NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted audio or video file. The issue affects only NGINX products that are built with the module ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_mp4_module. F5 Networks of nginx Products from other vendors have out-of-bounds write vulnerabilities.Information is obtained and service operation is interrupted (DoS) It may be in a state. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-5281-1 security@debian.org https://www.debian.org/security/ Moritz Muehlenhoff November 15, 2022 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : nginx CVE ID : CVE-2022-41741 CVE-2022-41742 It was discovered that parsing errors in the mp4 module of Nginx, a high-performance web and reverse proxy server, could result in denial of service, memory disclosure or potentially the execution of arbitrary code when processing a malformed mp4 file. This module is only enabled in the nginx-extras binary package. For the stable distribution (bullseye), these problems have been fixed in version 1.18.0-6.1+deb11u3. We recommend that you upgrade your nginx packages. For the detailed security status of nginx please refer to its security tracker page at: https://security-tracker.debian.org/tracker/nginx Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmNz9JcACgkQEMKTtsN8 Tjb4tg/7BRkAkF48UvvRjLolxVVuV1paSTRG8ArEeW3fHyA0fxs2UMuRL4ic1vqc i3wxAAfHvYoOnk+QBY20Ly2MN7S7OukNovKE9AZCPulyYkVjtIWNSBeY0PzCU60y RP/KCZAGoGEYi6s4SUrK194ved+7jIcybgLvvGA8FRKW3wTRvzRGMfR6NTLuP7B3 th0C5+KkapE8G5XlHWOIjv1h3Ok40cua7LtYx9RTITJ+wClvkJ6gPcCXXj/CnWWa PUvuEBwyr0PEBXfL9v1P8Eq1MmN+mWU9KeLYxIC+vcJxtpsYL67tMHIGTlDUgDVE FrXrDXi7XP/6hjl7t/J/cTPEwy/twX0emUQcUDlRNlOxh3skSmdPJP7DMu+t9UtQ suepgZ+oHfHh3gs9EWz2zRqbsVO03NjhKo9ebIjhe3H0P39cX3NN5qlSJeNTY45k VBDecnPQnhYqYuzqwXy5ZoUQDcU0Bo7zaUzeYhUsfXqrROV/tj+UTMrM2anHdQ4B kAOrCBpmGP1lLvDs2PzBcWmBtII/5VTKZep05xH0L+dZWDV07j1ekCzv3/kuKiMl GTJQ7yl3fgKjLdkjMFKQIfsm3xdYwzxjOmtEY86tUV0LjtdR2GlJtF4YdIQhA4b1 /R82ZisLfmZ4ElL+ua8iypLOe9reyO4EpVVDkeewFS64Ye1Wn3k=3mDY -----END PGP SIGNATURE-----

Trust: 1.8

sources: NVD: CVE-2022-41742 // JVNDB: JVNDB-2022-022651 // VULHUB: VHN-438029 // PACKETSTORM: 169909

AFFECTED PRODUCTS

vendor:f5model:nginxscope:eqversion:r1

Trust: 1.0

vendor:f5model:nginxscope:eqversion:1.23.1

Trust: 1.0

vendor:f5model:nginxscope:gteversion:r22

Trust: 1.0

vendor:f5model:nginx ingress controllerscope:lteversion:1.12.4

Trust: 1.0

vendor:f5model:nginxscope:lteversion:1.22.0

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:11.0

Trust: 1.0

vendor:f5model:nginxscope:eqversion:r2

Trust: 1.0

vendor:f5model:nginx ingress controllerscope:lteversion:2.4.0

Trust: 1.0

vendor:debianmodel:linuxscope:eqversion:10.0

Trust: 1.0

vendor:fedoraprojectmodel:fedorascope:eqversion:35

Trust: 1.0

vendor:f5model:nginxscope:lteversion:r27

Trust: 1.0

vendor:f5model:nginxscope:eqversion:1.23.0

Trust: 1.0

vendor:f5model:nginx ingress controllerscope:gteversion:1.9.0

Trust: 1.0

vendor:f5model:nginx ingress controllerscope:gteversion:2.0.0

Trust: 1.0

vendor:f5model:nginxscope:gteversion:1.1.3

Trust: 1.0

vendor:fedoraprojectmodel:fedorascope:eqversion:36

Trust: 1.0

vendor:fedoraprojectmodel:fedorascope:eqversion:37

Trust: 1.0

vendor:fedoramodel:fedorascope:eqversion:37

Trust: 0.8

vendor:fedoramodel:fedorascope:eqversion:36

Trust: 0.8

vendor:f5model:nginx ingress controllerscope: - version: -

Trust: 0.8

vendor:fedoramodel:fedorascope:eqversion:project

Trust: 0.8

vendor:f5model:nginxscope: - version: -

Trust: 0.8

vendor:debianmodel:gnu/linuxscope: - version: -

Trust: 0.8

vendor:fedoramodel:fedorascope:eqversion:35

Trust: 0.8

sources: JVNDB: JVNDB-2022-022651 // NVD: CVE-2022-41742

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-41742
value: HIGH

Trust: 1.0

f5sirt@f5.com: CVE-2022-41742
value: HIGH

Trust: 1.0

NVD: CVE-2022-41742
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202210-1409
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2022-41742
baseSeverity: HIGH
baseScore: 7.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.2
version: 3.1

Trust: 2.0

NVD: CVE-2022-41742
baseSeverity: HIGH
baseScore: 7.1
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2022-022651 // CNNVD: CNNVD-202210-1409 // NVD: CVE-2022-41742 // NVD: CVE-2022-41742

PROBLEMTYPE DATA

problemtype:CWE-787

Trust: 1.1

problemtype:Out-of-bounds writing (CWE-787) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-438029 // JVNDB: JVNDB-2022-022651 // NVD: CVE-2022-41742

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202210-1409

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202210-1409

PATCH

title:FEDORA-2022-97de53f202 Fedora Update Notificationurl:https://lists.debian.org/debian-lts-announce/2022/11/msg00031.html

Trust: 0.8

title:F5 Nginx Buffer error vulnerability fixurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=237346

Trust: 0.6

sources: JVNDB: JVNDB-2022-022651 // CNNVD: CNNVD-202210-1409

EXTERNAL IDS

db:NVDid:CVE-2022-41742

Trust: 3.4

db:JVNid:JVNVU93250330

Trust: 0.8

db:ICS CERTid:ICSA-24-165-13

Trust: 0.8

db:JVNDBid:JVNDB-2022-022651

Trust: 0.8

db:PACKETSTORMid:169909

Trust: 0.7

db:AUSCERTid:ESB-2022.6109

Trust: 0.6

db:AUSCERTid:ESB-2022.5959

Trust: 0.6

db:CNNVDid:CNNVD-202210-1409

Trust: 0.6

db:VULHUBid:VHN-438029

Trust: 0.1

sources: VULHUB: VHN-438029 // JVNDB: JVNDB-2022-022651 // PACKETSTORM: 169909 // CNNVD: CNNVD-202210-1409 // NVD: CVE-2022-41742

REFERENCES

url:https://security.netapp.com/advisory/ntap-20230120-0005/

Trust: 2.5

url:https://www.debian.org/security/2022/dsa-5281

Trust: 1.7

url:https://support.f5.com/csp/article/k28112382

Trust: 1.7

url:https://lists.debian.org/debian-lts-announce/2022/11/msg00031.html

Trust: 1.7

url:https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/bprvya4fs34vwb4fefynad7z2lfcjvei/

Trust: 1.0

url:https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/fd6m3pvvko35wlaa7gldbs6teq26sm64/

Trust: 1.0

url:https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/wborrvg7vvxyoaiad64zhes2u2viukfq/

Trust: 1.0

url:https://nvd.nist.gov/vuln/detail/cve-2022-41742

Trust: 0.9

url:https://jvn.jp/vu/jvnvu93250330/index.html

Trust: 0.8

url:https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-13

Trust: 0.8

url:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/wborrvg7vvxyoaiad64zhes2u2viukfq/

Trust: 0.7

url:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/fd6m3pvvko35wlaa7gldbs6teq26sm64/

Trust: 0.7

url:https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/bprvya4fs34vwb4fefynad7z2lfcjvei/

Trust: 0.7

url:https://www.auscert.org.au/bulletins/esb-2022.5959

Trust: 0.6

url:https://cxsecurity.com/cveshow/cve-2022-41742/

Trust: 0.6

url:https://packetstormsecurity.com/files/169909/debian-security-advisory-5281-1.html

Trust: 0.6

url:http-mp4-module-39638

Trust: 0.6

url:https://vigilance.fr/vulnerability/nginx-two-vulnerabilities-via-ngx-

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.6109

Trust: 0.6

url:https://security-tracker.debian.org/tracker/nginx

Trust: 0.1

url:https://www.debian.org/security/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-41741

Trust: 0.1

url:https://www.debian.org/security/faq

Trust: 0.1

sources: VULHUB: VHN-438029 // JVNDB: JVNDB-2022-022651 // PACKETSTORM: 169909 // CNNVD: CNNVD-202210-1409 // NVD: CVE-2022-41742

CREDITS

Debian

Trust: 0.1

sources: PACKETSTORM: 169909

SOURCES

db:VULHUBid:VHN-438029
db:JVNDBid:JVNDB-2022-022651
db:PACKETSTORMid:169909
db:CNNVDid:CNNVD-202210-1409
db:NVDid:CVE-2022-41742

LAST UPDATE DATE

2024-08-14T12:57:57.752000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-438029date:2023-02-10T00:00:00
db:JVNDBid:JVNDB-2022-022651date:2024-06-17T05:27:00
db:CNNVDid:CNNVD-202210-1409date:2023-05-15T00:00:00
db:NVDid:CVE-2022-41742date:2023-11-07T03:52:58.440

SOURCES RELEASE DATE

db:VULHUBid:VHN-438029date:2022-10-19T00:00:00
db:JVNDBid:JVNDB-2022-022651date:2023-11-20T00:00:00
db:PACKETSTORMid:169909date:2022-11-16T16:11:49
db:CNNVDid:CNNVD-202210-1409date:2022-10-19T00:00:00
db:NVDid:CVE-2022-41742date:2022-10-19T22:15:12.717