CVE-2022-41743

NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_hls_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its crash or potential other impact using a specially crafted audio or video file. The issue affects only NGINX Plus when the hls directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_hls_module.

CVSS v3 7.0 HIGH

7.0^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.0 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://support.f5.com/csp/article/K01112063	Mitigation Vendor Advisory
https://support.f5.com/csp/article/K01112063	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:f5:nginx_ingress_controller::::::::
	cpe:2.3:a:f5:nginx_ingress_controller::::::::
	cpe:2.3:a:f5:nginx_plus::::::::

History

21 Nov 2024, 07:23

Type	Values Removed	Values Added
References	~~() https://support.f5.com/csp/article/K01112063 - Mitigation, Vendor Advisory~~	() https://support.f5.com/csp/article/K01112063 - Mitigation, Vendor Advisory

Information

Published : 2022-10-19 22:15

Updated : 2024-11-21 07:23

NVD link : CVE-2022-41743

Mitre link : CVE-2022-41743

CVE.ORG link : CVE-2022-41743

JSON object : View

Products Affected

f5

nginx_ingress_controller
nginx_plus

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2022-41743", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "f5sirt@f5.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.0, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.0}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.0, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.0}]}, "published": "2022-10-19T22:15:12.807", "references": [{"url": "https://support.f5.com/csp/article/K01112063", "tags": ["Mitigation", "Vendor Advisory"], "source": "f5sirt@f5.com"}, {"url": "https://support.f5.com/csp/article/K01112063", "tags": ["Mitigation", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "f5sirt@f5.com", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_hls_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its crash or potential other impact using a specially crafted audio or video file. The issue affects only NGINX Plus when the hls directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_hls_module."}, {"lang": "es", "value": "NGINX Plus versiones anteriores a R27 P1 y R26 P1, presenta una vulnerabilidad en el m\u00f3dulo ngx_http_hls_module que podr\u00eda permitir a un atacante local corromper la memoria del trabajador de NGINX, resultando en su bloqueo o cualquier otro impacto potencial usando un archivo de audio o v\u00eddeo especialmente dise\u00f1ado. El problema s\u00f3lo afecta a NGINX Plus cuando es usada la directiva hls en el archivo de configuraci\u00f3n. Adem\u00e1s, el ataque s\u00f3lo es posible si un atacante puede activar el procesamiento de un archivo de audio o v\u00eddeo especialmente dise\u00f1ado con el m\u00f3dulo ngx_http_hls_module"}], "lastModified": "2024-11-21T07:23:46.587", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D4106C27-B217-4601-98E7-88067B60CE98", "versionEndIncluding": "1.12.4", "versionStartIncluding": "1.9.0"}, {"criteria": "cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0CEF860F-EF1E-4AAC-9122-F3A4A1510196", "versionEndIncluding": "2.4.0", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C821354A-EB13-45C2-9636-CD7B4ADC41EE", "versionEndIncluding": "r27", "versionStartIncluding": "r22"}], "operator": "OR"}]}], "sourceIdentifier": "f5sirt@f5.com"}