CVE-2021-23017 log
| Source |
|
| Severity | Medium |
| Remote | Yes |
| Type | Arbitrary code execution |
| Description | A security issue in nginx resolver was identified, which might allow an attacker to cause 1-byte memory overwrite by using a specially crafted DNS response, resulting in worker process crash or, potentially, in arbitrary code execution. The issue only affects nginx if the "resolver" directive is used in the configuration file. Further, the attack is only possible if an attacker is able to forge UDP packets from the DNS server. |
| Group | Package | Affected | Fixed | Severity | Status | Ticket |
|---|---|---|---|---|---|---|
| AVG-1988 | nginx | 1.20.0-1 | 1.20.1-1 | Medium | Fixed | |
| AVG-1987 | nginx-mainline | 1.19.10-1 | 1.21.0-1 | Medium | Fixed |
| Date | Advisory | Group | Package | Severity | Type |
|---|---|---|---|---|---|
| 22 Jun 2021 | ASA-202106-48 | AVG-1987 | nginx-mainline | Medium | arbitrary code execution |
| 15 Jun 2021 | ASA-202106-36 | AVG-1988 | nginx | Medium | arbitrary code execution |