Important: nginx:1.18 security update
Summary
ALSA-2021:2259: Important: nginx:1.18 security update. Affects nginx across 2 version ranges.
< 1:1.18.0-3.module_el8.5.0+36+48437aab.1.alma
< 1:1.18.0-3.module_el8.4.0+2472+f736ed63.1.alma
Fixed in 1:1.18.0-3.module_el8.5.0+36+48437aab.1.alma or 1:1.18.0-3.module_el8.4.0+2472+f736ed63.1.alma, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nginx is a web and proxy server that supports HTTP and other protocols. It is designed for high concurrency, performance, and low memory usage. The package is widely used in web hosting, reverse proxying, load balancing, and caching. It is vulnerable to an off-by-one error in the ngx_resolver_copy() function when labels are followed by a pointer to a root domain name.
Vulnerability Detail
The vulnerability in nginx (CVE-2021-23017) is an off-by-one error in the ngx_resolver_copy() function. This occurs when labels are followed by a pointer to a root domain name. An attacker could exploit this vulnerability to cause a denial-of-service (DoS) condition or potentially execute arbitrary code on the affected server. The impact of this vulnerability is considered important.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update nginx-
< 1:1.18.0-3.module_el8.4.0+2472+f736ed63.1.alma1:1.18.0-3.module_el8.4.0+2472+f736ed63.1.alma -
< 1:1.18.0-3.module_el8.5.0+36+48437aab.1.alma1:1.18.0-3.module_el8.5.0+36+48437aab.1.alma
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the nginx package to the fixed version.
Conclusion
In conclusion, the nginx package is vulnerable to an off-by-one error in the ngx_resolver_copy() function. This vulnerability can be fixed by updating the package to version 1.18.0-3.module_el8.5.0+36+48437aab.1.alma or later. If you require further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for nginx →
FAQ
nginx is a web and proxy server that supports HTTP and other protocols. It is known for its high concurrency, performance, and low memory usage.
The vulnerability could lead to a denial-of-service (DoS) condition or potential execution of arbitrary code on the affected server.
To fix this vulnerability, update the nginx package to version 1.18.0-3.module_el8.5.0+36+48437aab.1.alma or later.
There is no known workaround for this vulnerability. It is recommended to update the nginx package to the fixed version.
You can find more information about this vulnerability in the CVE page: CVE-2021-23017.
References
Related vulnerabilities
Recent vulnerabilities recorded for nginx.
