NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When content is served or proxied through a location block with both source_charset utf-8; and a charset directive (for example, charset koi8-r;) configured, remote, unauthenticated attackers can send requests (in conjunction with conditions beyond their control) to cause a heap buffer over-read in the NGINX worker process, leading to limited disclosure of memory or a restart. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| f5 | dos | 4.3.0 – ≤ 4.7.0 | |
| f5 | nginx gateway fabric | 1.3.0 – ≤ 1.6.2 | |
| f5 | nginx ingress controller | 3.5.0 – ≤ 3.7.2 | |
| f5 | nginx instance manager | 2.17.0 – ≤ 2.22.0 | |
| F5 | NGINX Open Source | 1.13.10 – < 1.31.2, 1.30.0 – < 1.30.3 | |
| F5 | NGINX Plus | 37.0 – < 37.0.2.1, R36 – < R36 P6 | |
| f5 | waf | 4.10.0 – ≤ 4.16.0 |
cpe:2.3:a:f5:dos:*:*:*:*:*:nginx:*:* ≥ 4.3.0 ≤ 4.7.0cpe:2.3:a:f5:dos:4.9.0:*:*:*:*:nginx:*:*cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:* ≥ 1.3.0 ≤ 1.6.2cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:* ≥ 2.0.0 ≤ 2.6.3cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:continuous_releases:*:*:* ≥ 3.5.0 ≤ 3.7.2cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:continuous_releases:*:*:* ≥ 4.0.0 ≤ 4.0.1cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:continuous_releases:*:*:* ≥ 5.0.0 ≤ 5.5.0cpe:2.3:a:f5:nginx_instance_manager:*:*:*:*:*:*:*:* ≥ 2.17.0 ≤ 2.22.0cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:* ≥ 1.0.0 ≤ 1.30.2cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:* ≥ 1.31.0 ≤ 1.31.1cpe:2.3:a:f5:nginx_plus:*:*:*:*:long-term_support:*:*:* ≥ 37.0.0.1 < 37.0.2.1cpe:2.3:a:f5:nginx_plus:*:*:*:*:continuous_releases:*:*:* ≥ r33 < r36cpe:2.3:a:f5:nginx_plus:r36:-:*:*:continuous_releases:*:*:*cpe:2.3:a:f5:nginx_plus:r36:p1:*:*:continuous_releases:*:*:*cpe:2.3:a:f5:nginx_plus:r36:p2:*:*:continuous_releases:*:*:*cpe:2.3:a:f5:nginx_plus:r36:p3:*:*:continuous_releases:*:*:*cpe:2.3:a:f5:nginx_plus:r36:p4:*:*:continuous_releases:*:*:*cpe:2.3:a:f5:nginx_plus:r36:p5:*:*:continuous_releases:*:*:*cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:* ≥ 4.10.0 ≤ 4.16.0cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:* ≥ 5.2.0 ≤ 5.8.0cpe:2.3:a:f5:waf:*:*:*:*:*:nginx:*:* ≥ 5.9.0 ≤ 5.13.1Ücretsiz ve açık kaynak honeypot sensörümüz, sunucunuzun kullanmadığı portlarda bekler; bağlanan tarayıcıları ve saldırganları ortak kara listeye bildirir.