High severity · published Oct 19, 2022
CVE-2022-41742
NGINX ngx_http_mp4_module vulnerability CVE-2022-41742
7.1
CVSS
1.2%
EPSS
No
On KEV
Description
NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted audio or video file. The issue affects only NGINX products that are built with the module ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_mp4_module.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NG
NGINX · F5
Mainline before 1.23.2; Stable before 1.22.1 · source: vendor, NVD
NO
NGINX Open Source Subscription · F5
R2 before R2 P1; R1 before R1 P1 · source: vendor
NP
NGINX Plus · F5
R27 before R27-p1; R1 before R26-p1 · source: vendor
DL
Debian Linux · Debian
10.0; 11.0 · source: NVD
FE
Fedora · Fedoraproject
35; 36; 37 · source: NVD
NI
Nginx Ingress Controller · F5
1.9.0 through 1.12.4; 2.0.0 through 2.4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-41742
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-41742
Mailing List
https://lists.debian.org/debian-lts-announce/2022/11/msg00031.html
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BPRVYA4FS34VWB4FEFYNAD7Z2LFCJVEI/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FD6M3PVVKO35WLAA7GLDBS6TEQ26SM64/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WBORRVG7VVXYOAIAD64ZHES2U2VIUKFQ/
Third Party Advisory
https://security.netapp.com/advisory/ntap-20230120-0005/
Mitigation
https://support.f5.com/csp/article/K28112382
More from NGINX
7.5
CVE-2023-44487
HTTP/2 Rapid Reset Attack Vulnerability
9.8
CVE-2017-20005
NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modification date in 1969 that causes an integer overflow (or a false…
9.8
CVE-2016-0746
Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (worker process crash) or…
9.8
CVE-2009-3555
The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and…
7.8
CVE-2022-41741
NGINX ngx_http_mp4_module vulnerability CVE-2022-41741