PT-2020-18768 · Nginx · Nginx Controller Agent

Published 2020-04-23 · Updated 2022-04-26 · CVE-2020-5867

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NGINX Controller Agent versions prior to 3.3.0

Description The issue concerns the NGINX Controller Agent installer script 'install.sh', which uses HTTP instead of HTTPS to check and install packages. This could potentially expose the system to man-in-the-middle attacks or eavesdropping.

Recommendations For versions prior to 3.3.0, update to version 3.3.0 or later to resolve the issue. As a temporary workaround, consider modifying the 'install.sh' script to use HTTPS instead of HTTP for checking and installing packages. Restrict access to the 'install.sh' script to minimize the risk of exploitation until the update is applied.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

CWE-494

Related Identifiers

CVE-2020-5867

Affected Products

Nginx Controller Agent

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-5867 · Security Note
• https://osv.dev/vulnerability/CVE-2020-5867 · Vendor Advisory
• https://support.f5.com/csp/article/K00958787 · Vendor Advisory
• https://t.me/cvenotify/29335 · Telegram Post
• https://security.netapp.com/advisory/ntap-20200430-0005 · Note
• https://t.me/cvenotify/3150 · Telegram Post