Nginx Web Server, Nginx Plus

CVE-2021-23017

HIGH 7.7

En bref

Source: NVD
EPSS: EPSS 53.46 % · centile 99 (2026-10-31)
État: PUBLISHED
Publiée: 2021-06-01 12:28 UTC
Mise à jour: 2024-08-03 18:58 UTC
Attribuée par: f5
Statut NVD: Modified

Rechercher sur…

Description

A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.

Faiblesses (CWE)

CWE-193 — Erreur de décalage d'une unité

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 7.7	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L	NVD · nvd@nist.gov (Primary)
CVSS 2.0	MEDIUM 6.8	AV:N/AC:M/Au:N/C:P/I:P/A:P	NVD · nvd@nist.gov (Primary)

Références européennes

ENISA EUVD · EUVD-2021-10135
GCVE · GCVE-0-2021-23017

Avis du CERT-FR

CERTFR-2024-AVI-0940 — Multiples vulnérabilités dans les produits Moxa · cert.ssi.gouv.fr
CERTFR-2024-AVI-0866 — Multiples vulnérabilités dans les produits Juniper Networks · cert.ssi.gouv.fr
CERTFR-2023-AVI-0051 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
CERTFR-2022-AVI-650 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
CERTFR-2022-AVI-351 — Multiples vulnérabilités dans les logiciels Juniper · cert.ssi.gouv.fr
CERTFR-2021-AVI-399 — Vulnérabilité dans Nginx · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:* ≥ 0.6.18 < 1.20.1
cpe:2.3:a:openresty:openresty:*:*:*:*:*:*:*:* < 1.19.3.2
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:* < 21.1.2
cpe:2.3:a:oracle:communications_control_plane_monitor:3.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_control_plane_monitor:4.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_control_plane_monitor:4.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_control_plane_monitor:4.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_fraud_monitor:*:*:*:*:*:*:*:* ≥ 3.4 ≤ 4.4
cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_operations_monitor:4.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_operations_monitor:4.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_operations_monitor:4.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_session_border_controller:8.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_session_border_controller:9.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_communications_broker:3.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_session_border_controller:8.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_session_border_controller:9.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_telephony_fraud_monitor:3.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_telephony_fraud_monitor:4.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_telephony_fraud_monitor:4.3:*:*:*:*:*:*:*
cpe:2.3:a:oracle:enterprise_telephony_fraud_monitor:4.4:*:*:*:*:*:*:*
cpe:2.3:a:oracle:goldengate:*:*:*:*:*:*:*:* < 21.4.0.0.0

Produits affectés

Produit	Versions
Nginx Web Server, Nginx Plus	affected Nginx Web Server versions 0.6.18 thru 1.20.0 before 1.20.1, Nginx plus versions R13 thru R23 before R23 P1. Nginx plus version R24 before R24 P1

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

⚠️ Nginx Web Server, Nginx Plus