PT-2020-18765 · Nginx · Nginx Plus+1

Published 2020-04-23 · Updated 2020-04-30 · CVE-2020-5864

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions NGINX Controller versions prior to 3.2.0

Description The issue concerns communication between NGINX Controller and NGINX Plus instances, where TLS verification is skipped by default. This affects versions of NGINX Controller prior to 3.2.0.

Recommendations For versions prior to 3.2.0, update to version 3.2.0 or later to ensure TLS verification is properly enforced. As a temporary workaround, consider configuring NGINX Controller to enable TLS verification manually until a patch is applied. Restrict access to NGINX Plus instances to minimize the risk of exploitation.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2020-5864

Affected Products

Nginx Controller

Nginx Plus

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-5864 · Security Note
• https://support.f5.com/csp/article/K27205552 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-5864 · Vendor Advisory
• https://t.me/cvenotify/3137 · Telegram Post
• https://security.netapp.com/advisory/ntap-20200430-0005 · Note