Published: 12/04/2020 Updated: 29/01/2021

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

An issue exists in OpenResty prior to 1.15.8.4. ngx_http_lua_subrequest.c allows HTTP request smuggling, as demonstrated by the ngx.location.capture API.

Vulnerable Product	Search on Vulmon	Subscribe to Product
openresty openresty
debian debian linux 9.0
debian debian linux 10.0

Debian Bug report logs - #964950 nginx: CVE-2020-11724 Package: nginx; Maintainer for nginx is Debian Nginx Maintainers <pkg-nginx-maintainers@alioth-listsdebiannet>; Source for nginx is src:nginx (PTS, buildd, popcon) Reported by: Sylvain Beucler <beuc@beucnet> Date: Mon, 13 Jul 2020 09:15:02 UTC Severity: grave ...

It was reported that the Lua module for Nginx, a high-performance web and reverse proxy server, is prone to a HTTP request smuggling vulnerability For the stable distribution (buster), this problem has been fixed in version 1142-2+deb10u3 We recommend that you upgrade your nginx packages For the detailed security status of nginx please refer t ...

nginx could be made to redirect network traffic ...

A security issue was fixed in nginx’s lua module ...

Several security issues were fixed in nginx ...

CWE-444 https://github.com/openresty/openresty/blob/4e8b4c395f842a078e429c80dd063b2323999957/patches/ngx_http_lua-0.10.15-fix_location_capture_content_length_chunked.patch https://github.com/openresty/lua-nginx-module/commit/9ab38e8ee35fc08a57636b1b6190dca70b0076fa https://lists.debian.org/debian-lts-announce/2020/07/msg00014.html https://www.debian.org/security/2020/dsa-4750 https://security.netapp.com/advisory/ntap-20210129-0002/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=964950 https://nvd.nist.gov https://ubuntu.com/security/notices/USN-5371-2 https://www.debian.org/security/2020/dsa-4750

CVE-2020-11724

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect