PT-2019-12520 · Nginx · Njs

Xeioexop · Publicado 2019-05-09 · Atualizado 2022-03-24 · CVE-2019-11837

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions njs versions prior to 0.3.2

Description The issue is related to a segmentation fault in String.prototype.toBytes for negative arguments. It is connected to the functions nxt utf8 next in nxt/nxt utf8.h and njs string offset in njs/njs string.c. This problem is found in njs, which is used in NGINX.

Recommendations For versions prior to 0.3.2, update to version 0.3.2 or later to resolve the issue.

Exploit

Correção

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2019-11837

Produtos afetados

Njs

Referências · 3

• 🔥 https://github.com/nginx/njs/issues/155 · Exploit
• https://osv.dev/vulnerability/CVE-2019-11837 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-11837 · Nota de Segurança