PT-2020-18766 · Nginx+1 · Nginx Controller+1

Published 2020-04-23 · Updated 2022-04-26 · CVE-2020-5865

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions NGINX Controller versions prior to 3.3.0

Description The issue concerns the NGINX Controller communicating with its Postgres database server over unencrypted channels, making the data vulnerable to interception via man-in-the-middle (MiTM) attacks.

Recommendations For versions prior to 3.3.0, update to version 3.3.0 or later to resolve the issue. As a temporary workaround, consider configuring the NGINX Controller to use encrypted communication channels with its Postgres database server. Restrict access to the database server to minimize the risk of exploitation.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2020-5865

Affected Products

Nginx Controller

Postgres

References · 6

• https://support.f5.com/csp/article/K21009022 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5865 · Security Note
• https://osv.dev/vulnerability/CVE-2020-5865 · Vendor Advisory
• https://t.me/cvenotify/3138 · Telegram Post
• https://security.netapp.com/advisory/ntap-20200430-0005 · Note
• https://t.me/cvenotify/29329 · Telegram Post