PT-2021-11997 · Unknown+3 · Ngx Http Lua Module+3

Published 2021-04-06 · Updated 2025-06-24 · CVE-2020-36309

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: ngx http lua module (aka lua-nginx-module) versions prior to 0.10.16

Description: The issue allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header.

Recommendations: For versions prior to 0.10.16, update to version 0.10.16 or later to resolve the issue.

Fix

Related Identifiers

BIT-OPENRESTY-2020-36309

CVE-2020-36309

DLA-4228-1

USN-5371-1

Affected Products

Debian

Linuxmint

Ubuntu

Ngx Http Lua Module

References · 18

• https://github.com/openresty/lua-nginx-module/compare/v0.10.15...v0.10.16 · Patch
• https://github.com/openresty/lua-nginx-module/pull/1654 · Patch
• https://ubuntu.com/security/notices/USN-5371-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-36309 · Security Note
• https://osv.dev/vulnerability/BIT-openresty-2020-36309 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36309 · Security Note
• https://ubuntu.com/security/CVE-2021-3618 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-36309 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-36309 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5371-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11724 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4228-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-36309 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-36309 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-36309 · Vendor Advisory