2022-09-28 20:00:37 +00:00
{
"CVE_data_meta" : {
2022-10-19 22:00:33 +00:00
"ASSIGNER" : "f5sirt@f5.com" ,
"DATE_PUBLIC" : "2022-10-19T14:00:00.000Z" ,
2022-09-28 20:00:37 +00:00
"ID" : "CVE-2022-41742" ,
2022-10-19 22:00:33 +00:00
"STATE" : "PUBLIC" ,
"TITLE" : "NGINX ngx_http_mp4_module vulnerability CVE-2022-41742"
2022-09-28 20:00:37 +00:00
} ,
2022-10-19 22:00:33 +00:00
"affects" : {
"vendor" : {
"vendor_data" : [
{
"product" : {
"product_data" : [
{
"product_name" : "NGINX" ,
"version" : {
"version_data" : [
{
"version_affected" : "<" ,
"version_name" : "Mainline" ,
"version_value" : "1.23.2"
} ,
{
"version_affected" : "<" ,
"version_name" : "Stable" ,
"version_value" : "1.22.1"
}
]
}
} ,
{
"product_name" : "NGINX Plus" ,
"version" : {
"version_data" : [
{
"version_affected" : "<" ,
"version_name" : "R27" ,
"version_value" : "R27-p1"
} ,
{
"version_affected" : "<" ,
"version_name" : "R1" ,
"version_value" : "R26-p1 "
}
]
}
} ,
{
"product_name" : "NGINX Open Source Subscription" ,
"version" : {
"version_data" : [
{
"version_affected" : "<" ,
"version_name" : "R2" ,
"version_value" : "R2 P1"
} ,
{
"version_affected" : "<" ,
"version_name" : "R1" ,
"version_value" : "R1 P1"
}
]
}
}
]
} ,
"vendor_name" : "F5"
}
]
}
} ,
"data_format" : "MITRE" ,
"data_type" : "CVE" ,
"data_version" : "4.0" ,
2022-09-28 20:00:37 +00:00
"description" : {
"description_data" : [
{
"lang" : "eng" ,
2022-10-19 22:00:33 +00:00
"value" : "NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted audio or video file. The issue affects only NGINX products that are built with the module ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_mp4_module."
}
]
} ,
"generator" : {
"engine" : "Vulnogram 0.0.9"
} ,
"impact" : {
"cvss" : {
"attackComplexity" : "LOW" ,
"attackVector" : "LOCAL" ,
"availabilityImpact" : "HIGH" ,
"baseScore" : 7.1 ,
"baseSeverity" : "HIGH" ,
"confidentialityImpact" : "HIGH" ,
"integrityImpact" : "NONE" ,
"privilegesRequired" : "LOW" ,
"scope" : "UNCHANGED" ,
"userInteraction" : "NONE" ,
"vectorString" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" ,
"version" : "3.1"
}
} ,
"problemtype" : {
"problemtype_data" : [
{
"description" : [
{
"lang" : "eng" ,
"value" : "CWE-787 Out-of-bounds Write"
}
]
2022-09-28 20:00:37 +00:00
}
]
2022-10-19 22:00:33 +00:00
} ,
"references" : {
"reference_data" : [
{
"refsource" : "MISC" ,
"url" : "https://support.f5.com/csp/article/K28112382" ,
"name" : "https://support.f5.com/csp/article/K28112382"
2022-10-28 13:00:31 +00:00
} ,
{
"refsource" : "FEDORA" ,
"name" : "FEDORA-2022-b0f5bc2175" ,
"url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BPRVYA4FS34VWB4FEFYNAD7Z2LFCJVEI/"
2022-10-28 14:00:31 +00:00
} ,
{
"refsource" : "FEDORA" ,
"name" : "FEDORA-2022-97de53f202" ,
"url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FD6M3PVVKO35WLAA7GLDBS6TEQ26SM64/"
2022-11-14 15:00:34 +00:00
} ,
{
"refsource" : "FEDORA" ,
"name" : "FEDORA-2022-12721789aa" ,
"url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WBORRVG7VVXYOAIAD64ZHES2U2VIUKFQ/"
2022-11-16 08:00:29 +00:00
} ,
{
"refsource" : "DEBIAN" ,
"name" : "DSA-5281" ,
"url" : "https://www.debian.org/security/2022/dsa-5281"
2022-11-23 02:00:33 +00:00
} ,
{
"refsource" : "MLIST" ,
"name" : "[debian-lts-announce] 20221122 [SECURITY] [DLA 3203-1] nginx security update" ,
"url" : "https://lists.debian.org/debian-lts-announce/2022/11/msg00031.html"
2022-10-19 22:00:33 +00:00
}
]
} ,
"source" : {
"defect" : [
"NWA-1396"
] ,
"discovery" : "EXTERNAL"
2022-09-28 20:00:37 +00:00
}
}
