CVE-2020-5895: High severity f5 nginx controller api management vulnerability
Published May 7, 2020
·Updated
On NGINX Controller versions 3.1.0-3.3.0, AVRD uses world-readable and world-writable permissions on its socket, which allows processes or users on the local system to write arbitrary data into the socket. A local system attacker can make AVRD segmentation fault (SIGSEGV) by writing malformed messages to the socket.
Affected Software
1 affected component
F5 Nginx Controller>=3.1.0<3.4.0
Event History
May 7, 2020
CVE Published
via MITRE·12:28 PM
Data Sourced
via MITRE·12:28 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2020-5895?
CVE-2020-5895 is considered a critical vulnerability that can be exploited by local attackers.
2
How do I fix CVE-2020-5895?
To fix CVE-2020-5895, upgrade NGINX Controller to version 3.4.0 or later.
3
What versions of NGINX Controller are affected by CVE-2020-5895?
NGINX Controller versions from 3.1.0 to 3.3.0 are affected by CVE-2020-5895.
4
What type of attack can CVE-2020-5895 facilitate?
CVE-2020-5895 can facilitate local denial of service attacks through socket manipulation.
5
Who is impacted by CVE-2020-5895?
Organizations using the vulnerable versions of NGINX Controller are at risk due to CVE-2020-5895.