PT-2019-5778 · Nginx · Njs

Shuoz · Published 2019-06-03 · Updated 2022-03-24 · CVE-2019-13617

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions njs versions through 0.3.3

Description The issue is related to a heap-based buffer over-read in the nxt vsprintf function in nxt/nxt sprintf.c during error handling. This can occur when an njs regexp literal call leads to an njs parser lexer error call and then an njs parser scope error call. The vulnerability may allow a remote attacker to cause a denial of service.

Recommendations For njs versions through 0.3.3, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2021-02124

CVE-2019-13617

Affected Products

Njs

References · 8

• 🔥 https://github.com/nginx/njs/issues/174 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-13617 · Security Note
• https://osv.dev/vulnerability/CVE-2019-13617 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02124 · Security Note
• https://github.com/nginx/njs/commit/ee400ea880dc46bb02c4be2564b183c114d4cd42 · Note
• https://cxsecurity.com/cveshow/CVE-2019-13617 · Note
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15093 · Note
• https://ibm.com/support/pages/node/3655191 · Note