Detections
Analytics
Alpine: nginx: security update to 1.12.1-r4
medium Tenable Cloud Security Plugin ID 405751
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow
for excessive memory consumption. This issue affects nginx compiled with the ngx_http_v2_module (not
compiled by default) if the 'http2' option of the 'listen' directive is used in a configuration file.
(CVE-2018-16843)
- nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow
for excessive CPU usage. This issue affects nginx compiled with the ngx_http_v2_module (not compiled by
default) if the 'http2' option of the 'listen' directive is used in a configuration file. (CVE-2018-16844)
- nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_module, which might allow an
attacker to cause infinite loop in a worker process, cause a worker process crash, or might result in
worker process memory disclosure by using a specially crafted mp4 file. The issue only affects nginx if it
is built with the ngx_http_mp4_module (the module is not built by default) and the .mp4. directive is used
in the configuration file. Further, the attack is only possible if an attacker is able to trigger
processing of a specially crafted mp4 file with the ngx_http_mp4_module. (CVE-2018-16845)
See Also
https://security.alpinelinux.org/vuln/CVE-2018-16843
Plugin Details
Severity: Medium
ID: 405751
Version: Revision 1.27
Type: Local
Published: 10/31/2023
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 5
Percentile: 94.39
CVSS v2
Risk Factor: Medium
Base Score: 5.8
Temporal Score: 4.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:P
CVSS Score Source: CVE-2018-16845
CVSS v3
Risk Factor: Medium
Base Score: 6.1
Temporal Score: 5.3
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 11/6/2018
Reference Information
CVE: CVE-2018-16843, CVE-2018-16844, CVE-2018-16845
BID: 105868
IAVB: 2018-B-0143-S