CVE-2021-23017critical
New! CVE Severity Now Using CVSS v3
The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Description
A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.
References
http://mailman.nginx.org/pipermail/nginx-announce/2021/000300.html
https://support.f5.com/csp/article/K12331123,
https://lists.apache.org/thread.html/[email protected]%3Cnotifications.apisix.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Cnotifications.apisix.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Cnotifications.apisix.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Cnotifications.apisix.apache.org%3E
https://lists.apache.org/thread.html/[email protected]%3Cnotifications.apisix.apache.org%3E
Details
Source: MITRE
Published: 2021-06-01
Updated: 2021-10-20
Type: CWE-193
Risk Information
CVSS v2
Base Score: 6.8
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Impact Score: 6.4
Exploitability Score: 8.6
Severity: MEDIUM
CVSS v3
Base Score: 9.4
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Impact Score: 5.5
Exploitability Score: 3.9
Severity: CRITICAL
Vulnerable Software
Configuration 1
OR
Configuration 2
OR
Configuration 3
OR
Configuration 4
OR
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 153261 | EulerOS 2.0 SP2 : nginx (EulerOS-SA-2021-2412) | Nessus | Huawei Local Security Checks | critical |
| 153068 | EulerOS 2.0 SP5 : nginx (EulerOS-SA-2021-2340) | Nessus | Huawei Local Security Checks | critical |
| 152409 | EulerOS 2.0 SP8 : nginx (EulerOS-SA-2021-2308) | Nessus | Huawei Local Security Checks | critical |
| 151752 | openSUSE 15 Security Update : nginx (openSUSE-SU-2021:1815-1) | Nessus | SuSE Local Security Checks | critical |
| 150835 | CentOS 8 : nginx:1.18 (CESA-2021:2259) | Nessus | CentOS Local Security Checks | critical |
| 150833 | CentOS 8 : nginx:1.16 (CESA-2021:2290) | Nessus | CentOS Local Security Checks | critical |
| 150786 | RHEL 7 : rh-nginx118-nginx (RHSA-2021:2258) | Nessus | Red Hat Local Security Checks | critical |
| 150785 | RHEL 7 : rh-nginx116-nginx (RHSA-2021:2278) | Nessus | Red Hat Local Security Checks | critical |
| 150496 | Oracle Linux 8 : nginx:1.16 (ELSA-2021-2290) | Nessus | Oracle Linux Local Security Checks | critical |
| 150349 | Oracle Linux 8 : nginx:1.18 (ELSA-2021-2259) | Nessus | Oracle Linux Local Security Checks | critical |
| 150346 | RHEL 8 : nginx:1.16 (RHSA-2021:2290) | Nessus | Red Hat Local Security Checks | critical |
| 150276 | openSUSE Security Update : nginx (openSUSE-2021-835) | Nessus | SuSE Local Security Checks | critical |
| 150223 | SUSE SLES15 Security Update : nginx (SUSE-SU-2021:1839-1) | Nessus | SuSE Local Security Checks | critical |
| 150154 | nginx 0.6.x < 1.20.1 1-Byte Memory Overwrite RCE | Nessus | Web Servers | critical |
| 150150 | Amazon Linux AMI : nginx (ALAS-2021-1507) | Nessus | Amazon Linux Local Security Checks | critical |
| 150115 | Debian DSA-4921-1 : nginx - security update | Nessus | Debian Local Security Checks | critical |
| 150102 | SUSE SLES15 Security Update : nginx (SUSE-SU-2021:1792-1) | Nessus | SuSE Local Security Checks | critical |
| 150097 | Debian DLA-2670-1 : nginx security update | Nessus | Debian Local Security Checks | critical |
| 150093 | SUSE SLES15 Security Update : nginx (SUSE-SU-2021:1815-1) | Nessus | SuSE Local Security Checks | critical |
| 150082 | SUSE SLES15 Security Update : nginx (SUSE-SU-2021:1814-1) | Nessus | SuSE Local Security Checks | critical |
| 150071 | Photon OS 2.0: Nginx PHSA-2021-2.0-0349 | Nessus | PhotonOS Local Security Checks | critical |
| 150047 | Photon OS 1.0: Nginx PHSA-2021-1.0-0394 | Nessus | PhotonOS Local Security Checks | critical |
| 150041 | Photon OS 3.0: Nginx PHSA-2021-3.0-0243 | Nessus | PhotonOS Local Security Checks | critical |
| 150038 | Photon OS 4.0: Nginx PHSA-2021-4.0-0032 | Nessus | PhotonOS Local Security Checks | critical |
| 150029 | Ubuntu 16.04 LTS : nginx vulnerability (USN-4967-2) | Nessus | Ubuntu Local Security Checks | critical |
| 149991 | Ubuntu 18.04 LTS / 20.04 LTS / 20.10 / 21.04 : nginx vulnerability (USN-4967-1) | Nessus | Ubuntu Local Security Checks | critical |
| 149974 | FreeBSD : NGINX -- 1-byte memory overwrite in resolver (0882f019-bd60-11eb-9bdd-8c164567ca3c) | Nessus | FreeBSD Local Security Checks | critical |
| 112796 | Nginx < 1.20.1 Off-By-One Heap Write | Web Application Scanning | Component Vulnerability | critical |