PT-2021-7023 · Nginx · Nginx Ingress Controller

Published 2021-01-06 · Updated 2023-11-06 · CVE-2021-23055

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions NGINX Ingress Controller versions 1.x through 1.12.3 NGINX Ingress Controller versions 2.x through 2.0.3

Description The issue is related to insufficient permission assignment checking for a critical resource in the NGINX Ingress Controller command line handler. This could allow a remote attacker to disclose protected information. The command line restriction that controls snippet use with NGINX Ingress Controller does not apply to Ingress objects.

Recommendations For NGINX Ingress Controller versions 1.x through 1.12.3, update to version 1.12.3 or later. For NGINX Ingress Controller versions 2.x through 2.0.3, update to version 2.0.3 or later. As a temporary workaround, consider restricting access to Ingress objects until a patch is available.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

BDU:2022-02986

BIT-NGINX-INGRESS-CONTROLLER-2021-23055

CVE-2021-23055

Affected Products

Nginx Ingress Controller

References · 9

• https://bdu.fstec.ru/vul/2022-02986 · Security Note
• https://osv.dev/vulnerability/BIT-nginx-ingress-controller-2021-23055 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23055 · Security Note
• https://support.f5.com/csp/article/K01051452 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-23055 · Vendor Advisory
• https://github.com/advisories/GHSA-38cm-wqx5-m22m · Note
• https://t.me/cvenotify/35437 · Telegram Post
• https://vuldb.com/?id.198380 · Note
• https://t.me/cibsecurity/41246 · Telegram Post