Moderate: nginx:1.22 security update
Summary
ALSA-2023:5713: Moderate: nginx:1.22 security update. Affects nginx versions < 1:1.22.1-1.module_el8.8.0+3623+f96e6422.1.alma.1. Fixed in 1:1.22.1-1.module_el8.8.0+3623+f96e6422.1.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nginx is a web and proxy server that supports HTTP and other protocols. It is known for its high concurrency, performance, and low memory usage. The vulnerability affects nginx version 1.22.
Vulnerability Detail
The vulnerability (CVE-2023-44487) is related to HTTP/2 and can be exploited to launch a DDoS attack known as Rapid Reset Attack. Multiple HTTP/2 enabled web servers are susceptible to this attack. The impact of the vulnerability can lead to service disruption and denial of service.
How To Fix
Minimum fixed version
1:1.22.1-1.module_el8.8.0+3623+f96e6422.1.alma.1
This is the first release that contains the fix.
sudo dnf update nginxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
To protect your system from the DDoS attack vulnerability in nginx version 1.22, it is crucial to update to version 1.22.1-1.module_el8.8.0+3623+f96e6422.1.alma.1 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nginx →
FAQ
nginx is a web and proxy server that supports HTTP and other protocols. It is designed for high concurrency, performance, and low memory usage.
The vulnerability can be exploited to launch a DDoS attack, leading to service disruption and denial of service.
To fix the vulnerability, update nginx to version 1.22.1-1.module_el8.8.0+3623+f96e6422.1.alma.1 or later.
No specific workaround has been provided for this vulnerability.
You can find more information about the vulnerability in the CVE page linked in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for nginx.
