PT-2019-8800 · Nginx · Nginx

Publicado 2019-03-07 · Atualizado 2019-03-18 · CVE-2018-11783

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions nginx versions 6.0.0 through 6.0.3 nginx versions 7.0.0 through 7.1.5 nginx versions 8.0.0 through 8.0.1

Description The issue arises from the sslheaders plugin, which extracts client certificate information and sets request headers based on its configuration. However, in certain scenarios, the plugin fails to strip these headers from the request.

Recommendations For versions 6.0.0 through 6.0.3, update to a version outside of this range to resolve the issue. For versions 7.0.0 through 7.1.5, update to a version outside of this range to resolve the issue. For versions 8.0.0 through 8.0.1, update to a version outside of this range to resolve the issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2018-11783

Produtos afetados

Nginx

Referências · 12

• https://github.com/apache/trafficserver/pull/4701 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-11783 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-11783 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-11783 · Aviso do Fabricante
• https://openwall.com/lists/oss-security/2019/02/13/6 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-11783 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11783 · Nota
• https://lists.apache.org/thread.html/4f102f943935476732fb1fb653d687c7b69d29d9792f0d6cf72c505e%40%3Cannounce.trafficserver.apache.org%3E · Nota
• https://cve.org/CVERecord?id=CVE-2018-11783 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-11783 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2018-11783 · Aviso do Fabricante
• http://securityfocus.com/bid/107032 · Nota