PT-2020-2709 · Nginx · Nginx Controller

Published 2020-05-06 · Updated 2022-07-12 · CVE-2020-5895

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NGINX Controller versions 3.1.0 through 3.3.0

Description The issue is related to a buffer overflow in memory, which can allow an attacker to execute arbitrary code. On the local system, processes or users can write arbitrary data into the socket due to world-readable and world-writable permissions, potentially causing a segmentation fault by writing malformed messages to the socket.

Recommendations For NGINX Controller versions 3.1.0 through 3.3.0, consider restricting access to the socket to prevent local system attackers from writing arbitrary data into it. As a temporary workaround, restrict the use of the AVRD socket until a patch is available.

Fix

Buffer Overflow

Incorrect Permission

Weakness Enumeration

CWE-119

CWE-732

Related Identifiers

BDU:2020-02785

CVE-2020-5895

Affected Products

Nginx Controller

References · 8

• https://osv.dev/vulnerability/CVE-2020-5895 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02785 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-5895 · Security Note
• https://support.f5.com/csp/article/K95120415 · Vendor Advisory
• https://docs.nginx.com/nginx-controller/releases/#nginx-controller-version-3-4-0 · Note
• https://t.me/cvenotify/3607 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2020050623 · Note
• https://security.netapp.com/advisory/ntap-20200522-0001 · Note