Recent Vulnerabilities Research Posts Trends Blog About Contact

Related Vulnerabilities: CVE-2022-41741 CVE-2022-41742

NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its termination or potential other impact using a specially crafted audio or video file. The issue affects only NGINX products that are built with the ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_mp4_module. (CVE-2022-41741) NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted audio or video file. The issue affects only NGINX products that are built with the module ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_mp4_module. (CVE-2022-41742)

Source

ALAS2022-2023-270

Amazon Linux 2022 Security Advisory: ALAS-2023-270
Advisory Release Date: 2023-01-20 16:44 Pacific
Advisory Updated Date: 2023-01-24 21:22 Pacific

Severity: Medium

References: CVE-2022-41741 CVE-2022-41742

Issue Overview:

NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its termination or potential other impact using a specially crafted audio or video file. The issue affects only NGINX products that are built with the ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_mp4_module. (CVE-2022-41741)

NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted audio or video file. The issue affects only NGINX products that are built with the module ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_mp4_module. (CVE-2022-41742)

Affected Packages:

nginx

Issue Correction:
Run dnf update nginx to update your system.

New Packages:

aarch64:
    nginx-debuginfo-1.22.1-1.amzn2022.0.1.aarch64
    nginx-mod-http-perl-1.22.1-1.amzn2022.0.1.aarch64
    nginx-mod-http-perl-debuginfo-1.22.1-1.amzn2022.0.1.aarch64
    nginx-mod-http-image-filter-debuginfo-1.22.1-1.amzn2022.0.1.aarch64
    nginx-mod-http-xslt-filter-1.22.1-1.amzn2022.0.1.aarch64
    nginx-mod-mail-debuginfo-1.22.1-1.amzn2022.0.1.aarch64
    nginx-1.22.1-1.amzn2022.0.1.aarch64
    nginx-mod-http-image-filter-1.22.1-1.amzn2022.0.1.aarch64
    nginx-mod-stream-1.22.1-1.amzn2022.0.1.aarch64
    nginx-mod-stream-debuginfo-1.22.1-1.amzn2022.0.1.aarch64
    nginx-core-debuginfo-1.22.1-1.amzn2022.0.1.aarch64
    nginx-mod-mail-1.22.1-1.amzn2022.0.1.aarch64
    nginx-core-1.22.1-1.amzn2022.0.1.aarch64
    nginx-mod-http-xslt-filter-debuginfo-1.22.1-1.amzn2022.0.1.aarch64
    nginx-mod-devel-1.22.1-1.amzn2022.0.1.aarch64
    nginx-debugsource-1.22.1-1.amzn2022.0.1.aarch64

i686:
    nginx-core-debuginfo-1.22.1-1.amzn2022.0.1.i686
    nginx-core-1.22.1-1.amzn2022.0.1.i686
    nginx-debugsource-1.22.1-1.amzn2022.0.1.i686
    nginx-mod-devel-1.22.1-1.amzn2022.0.1.i686
    nginx-mod-stream-debuginfo-1.22.1-1.amzn2022.0.1.i686
    nginx-mod-mail-debuginfo-1.22.1-1.amzn2022.0.1.i686
    nginx-mod-stream-1.22.1-1.amzn2022.0.1.i686
    nginx-mod-http-perl-debuginfo-1.22.1-1.amzn2022.0.1.i686
    nginx-1.22.1-1.amzn2022.0.1.i686
    nginx-mod-mail-1.22.1-1.amzn2022.0.1.i686
    nginx-debuginfo-1.22.1-1.amzn2022.0.1.i686
    nginx-mod-http-xslt-filter-debuginfo-1.22.1-1.amzn2022.0.1.i686
    nginx-mod-http-image-filter-debuginfo-1.22.1-1.amzn2022.0.1.i686
    nginx-mod-http-perl-1.22.1-1.amzn2022.0.1.i686
    nginx-mod-http-xslt-filter-1.22.1-1.amzn2022.0.1.i686
    nginx-mod-http-image-filter-1.22.1-1.amzn2022.0.1.i686

noarch:
    nginx-all-modules-1.22.1-1.amzn2022.0.1.noarch
    nginx-filesystem-1.22.1-1.amzn2022.0.1.noarch

src:
    nginx-1.22.1-1.amzn2022.0.1.src

x86_64:
    nginx-mod-http-xslt-filter-debuginfo-1.22.1-1.amzn2022.0.1.x86_64
    nginx-mod-http-xslt-filter-1.22.1-1.amzn2022.0.1.x86_64
    nginx-1.22.1-1.amzn2022.0.1.x86_64
    nginx-mod-http-image-filter-1.22.1-1.amzn2022.0.1.x86_64
    nginx-debuginfo-1.22.1-1.amzn2022.0.1.x86_64
    nginx-mod-http-image-filter-debuginfo-1.22.1-1.amzn2022.0.1.x86_64
    nginx-core-debuginfo-1.22.1-1.amzn2022.0.1.x86_64
    nginx-mod-http-perl-1.22.1-1.amzn2022.0.1.x86_64
    nginx-mod-mail-debuginfo-1.22.1-1.amzn2022.0.1.x86_64
    nginx-mod-stream-1.22.1-1.amzn2022.0.1.x86_64
    nginx-mod-stream-debuginfo-1.22.1-1.amzn2022.0.1.x86_64
    nginx-core-1.22.1-1.amzn2022.0.1.x86_64
    nginx-mod-devel-1.22.1-1.amzn2022.0.1.x86_64
    nginx-mod-mail-1.22.1-1.amzn2022.0.1.x86_64
    nginx-mod-http-perl-debuginfo-1.22.1-1.amzn2022.0.1.x86_64
    nginx-debugsource-1.22.1-1.amzn2022.0.1.x86_64

Additional References

Red Hat: CVE-2022-41741, CVE-2022-41742

Mitre: CVE-2022-41741, CVE-2022-41742

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

ALAS2022-2023-270

ALAS2022-2023-270

Additional References

Vulmon Search

About

Products

Connect