Resource Exhaustion Affecting nginx package, versions <1.6.2-5+deb8u6
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIAN8-NGINX-340942
- published 2 Dec 2018
- disclosed 7 Nov 2018
Introduced: 7 Nov 2018
CVE-2018-16845 Open this link in a new tabHow to fix?
Upgrade Debian:8
nginx
to version 1.6.2-5+deb8u6 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream nginx
package and not the nginx
package as distributed by Debian
.
See How to fix?
for Debian:8
relevant fixed versions and status.
nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_module, which might allow an attacker to cause infinite loop in a worker process, cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted mp4 file. The issue only affects nginx if it is built with the ngx_http_mp4_module (the module is not built by default) and the .mp4. directive is used in the configuration file. Further, the attack is only possible if an attacker is able to trigger processing of a specially crafted mp4 file with the ngx_http_mp4_module.
References
- https://security-tracker.debian.org/tracker/CVE-2018-16845
- https://support.apple.com/kb/HT212818
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16845
- https://www.debian.org/security/2018/dsa-4335
- https://lists.debian.org/debian-lts-announce/2018/11/msg00010.html
- http://seclists.org/fulldisclosure/2021/Sep/36
- http://mailman.nginx.org/pipermail/nginx-announce/2018/000221.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16845
- https://access.redhat.com/errata/RHSA-2018:3652
- https://access.redhat.com/errata/RHSA-2018:3653
- https://access.redhat.com/errata/RHSA-2018:3680
- https://access.redhat.com/errata/RHSA-2018:3681
- http://www.securityfocus.com/bid/105868
- http://www.securitytracker.com/id/1042039
- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-16845
- https://usn.ubuntu.com/3812-1/