NGINX versions 1.30.6 and 1.31.7 patch five vulnerabilities, including a long-standing flaw present in every release since May 2005.
The release covers three memory bugs, a TLS session verification flaw, and an HTTP/3 request handling issue, alongside njs 1.0.2 fixes.
What are the problems identified?
According to the estimates, the issues are divided into several categories depending on how they operate:
- Memory management problems: Three of the issues involve system memory and could theoretically crash the system or allow someone to run their own code, although very specific settings are required for this to happen.
- Fake secure connections: A fourth problem allows the creation of fake connections that could bypass authentication checks. However, this process is completely random and cannot be controlled by an attacker.
- Additional data traffic: The fifth problem allows those communicating with the system to send additional data along with their requests to the backend.
Rating and risk
NGINX rates all five issues as moderate severity. For its part, F5 rates the three memory issues at 9.2 (critical), the secure connections issue at 8.3, and the data issue at 6.9.
As of October 15, none of the five issues were on official lists of known attacks, and neither NGINX nor F5 had reported actual attacks.
READ ALSO
Drupal issues urgent security fixes for serious remote control issue
On the same day, NGINX also released njs 1.0.2, which fixes two more moderate severity issues related to XML file handling in the JavaScript section.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)