PT-2018-2563 · Nginx+4 · Nginx+4
Sam Fowler
·
Publicado
2018-11-06
·
Atualizado
2026-04-21
·
CVE-2018-16845
CVSS v3.1
8.2
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
nginx versions 1.15.6 and earlier, 1.14.1 and earlier
Description
The issue is related to the ngx http mp4 module in nginx, which might allow an attacker to cause an infinite loop in a worker process, cause a worker process crash, or result in worker process memory disclosure by using a specially crafted mp4 file. The attack is only possible if an attacker is able to trigger processing of a specially crafted mp4 file with the ngx http mp4 module and if the module is built and the .mp4 directive is used in the configuration file.
Recommendations
For versions prior to 1.15.6 and 1.14.1, update to version 1.21.0 or later to resolve the issue.
As a temporary workaround, consider disabling the ngx http mp4 module until a patch is available.
Restrict access to the .mp4 directive in the configuration file to minimize the risk of exploitation.
Avoid using the ngx http mp4 module to process mp4 files until the issue is resolved.
Correção
Resource Exhaustion
Infinite Loop
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Apple Macos
Nginx
Suse
Ubuntu