PT-2020-3784 · Openresty+2 · Openresty+2

Published 2020-04-12 · Updated 2022-10-07 · CVE-2020-11724

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions: OpenResty versions prior to 1.15.8.4

Description: The issue is related to HTTP request smuggling in the ngx http lua subrequest.c component of the OpenResty web server. This is due to inconsistent interpretation of HTTP requests. The vulnerability can be exploited by a remote attacker to impact data integrity. The ngx.location.capture API is affected.

Recommendations: For versions prior to 1.15.8.4, update to version 1.15.8.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the ngx http lua subrequest.c component until a patch is available. Avoid using the ngx.location.capture API in affected versions until the issue is resolved.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

BDU:2020-04146

CVE-2020-11724

DLA-2283-1

DSA-4750-1

USN-5371-1

USN-5371-3

Affected Products

Linuxmint

Openresty

Ubuntu

References · 23

• https://github.com/openresty/openresty/blob/4e8b4c395f842a078e429c80dd063b2323999957/patches/ngx_http_lua-0.10.15-fix_location_capture_content_length_chunked.patch · Patch
• https://github.com/openresty/lua-nginx-module/commit/9ab38e8ee35fc08a57636b1b6190dca70b0076fa · Patch
• https://security-tracker.debian.org/tracker/CVE-2020-11724 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5371-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-11724 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5371-3 · Vendor Advisory
• https://debian.org/security/2020/dsa-4750 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5371-3 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04146 · Security Note
• https://ubuntu.com/security/CVE-2020-36309 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3618 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2283-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4750-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5371-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11724 · Vendor Advisory