PT-2023-11600 · Tdengine+1 · Tdengine+1

Published 2023-08-22 · Updated 2023-08-28 · CVE-2020-21699

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tengine version 2.2.2 Tengine versions 0.5.6 through 1.13.2

Description The web server is vulnerable to an integer overflow vulnerability in the nginx range filter module. This vulnerability results in the leakage of potentially sensitive information when triggered by specially crafted requests.

Recommendations For Tengine version 2.2.2, update to a version that is not based on the vulnerable Nginx range. For Tengine versions 0.5.6 through 1.13.2, consider disabling the nginx range filter module as a temporary workaround until a patch is available.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2020-21699

Affected Products

Nginx

Tdengine

References · 7

• 🔥 https://github.com/ZxDecide/Nginx-variants/blob/master/%E9%99%84%E4%BB%B6(Tengine).docx · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-21699 · Security Note
• https://osv.dev/vulnerability/CVE-2020-21699 · Vendor Advisory
• https://github.com/ZxDecide/Nginx-variants/blob/master/%E9%99%84%E4%BB%B6%28Tengine%29.docx · Note
• https://t.me/cvenotify/57097 · Telegram Post
• https://t.me/cvenotify/57466 · Telegram Post
• https://t.me/cibsecurity/68958 · Telegram Post