CVE-2022-41741: NGINX ngx_http_mp4_module vulnerability CVE-2022-41741
First published: Wed Oct 19 2022(Updated: )
NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its termination or potential other impact using a specially crafted audio or video file. The issue affects only NGINX products that are built with the ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_mp4_module.
Credit: f5sirt@f5.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| debian/nginx | <=1.14.2-2+deb10u4 | 1.14.2-2+deb10u5 1.18.0-6.1+deb11u3 1.22.1-9 1.24.0-2 |
| F5 Nginx | >=1.1.3<=1.22.0 | |
| F5 Nginx | >=r22<=r27 | |
| F5 Nginx | =1.23.0 | |
| F5 Nginx | =1.23.1 | |
| F5 Nginx | =r1 | |
| F5 Nginx | =r2 | |
| F5 NGINX Ingress Controller | >=1.9.0<=1.12.4 | |
| F5 NGINX Ingress Controller | >=2.0.0<=2.4.0 | |
| Fedoraproject Fedora | =35 | |
| Fedoraproject Fedora | =36 | |
| Fedoraproject Fedora | =37 | |
| Debian Debian Linux | =10.0 | |
| Debian Debian Linux | =11.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/nginx/nginx/commit/6b022a5556af22b6e18532e547a6ae46b0d8c6ea
- https://security-tracker.debian.org/tracker/CVE-2022-41741
- https://lists.debian.org/debian-lts-announce/2022/11/msg00031.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BPRVYA4FS34VWB4FEFYNAD7Z2LFCJVEI/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FD6M3PVVKO35WLAA7GLDBS6TEQ26SM64/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WBORRVG7VVXYOAIAD64ZHES2U2VIUKFQ/
- https://security.netapp.com/advisory/ntap-20230120-0005/
- https://support.f5.com/csp/article/K81926432
- https://www.debian.org/security/2022/dsa-5281
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BPRVYA4FS34VWB4FEFYNAD7Z2LFCJVEI/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FD6M3PVVKO35WLAA7GLDBS6TEQ26SM64/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WBORRVG7VVXYOAIAD64ZHES2U2VIUKFQ/
Frequently Asked Questions
What is CVE-2022-41741?
CVE-2022-41741 is a vulnerability in NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 that allows a local attacker to corrupt NGINX worker memory.
What is the severity of CVE-2022-41741?
The severity of CVE-2022-41741 is high with a CVSS score of 7.8.
How can a local attacker exploit CVE-2022-41741?
A local attacker can exploit CVE-2022-41741 to corrupt NGINX worker memory.
Which versions of NGINX Open Source and NGINX Plus are affected by CVE-2022-41741?
NGINX Open Source versions before 1.23.2 and 1.22.1, NGINX Open Source Subscription versions before R2 P1 and R1 P1, and NGINX Plus versions before R27 P1 and R26 P1 are affected by CVE-2022-41741.
How can I fix CVE-2022-41741?
To fix CVE-2022-41741, upgrade NGINX Open Source to version 1.23.2 or 1.22.1, NGINX Open Source Subscription to version R2 P1 or R1 P1, or NGINX Plus to version R27 P1 or R26 P1.
- collector/security-tracker-debian
- agent/type
- agent/weakness
- agent/author
- agent/description
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/last-modified-date
- agent/title
- agent/severity
- agent/tags
- agent/first-publish-date
- agent/event
- package-manager/debian
- vendor/f5
- canonical/f5 nginx
- version/f5 nginx/1.1.3
- version/f5 nginx/1.22.0
- version/f5 nginx/r22
- version/f5 nginx/r27
- version/f5 nginx/1.23.0
- version/f5 nginx/1.23.1
- version/f5 nginx/r1
- version/f5 nginx/r2
- canonical/f5 nginx ingress controller
- version/f5 nginx ingress controller/1.9.0
- version/f5 nginx ingress controller/1.12.4
- version/f5 nginx ingress controller/2.0.0
- version/f5 nginx ingress controller/2.4.0
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/35
- version/fedoraproject fedora/36
- version/fedoraproject fedora/37
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/10.0
- version/debian debian linux/11.0