What software is affected by CVE-2022-41743?

The affected software includes NGINX Plus versions R27 and R26.

What is the severity of CVE-2022-41743?

CVE-2022-41743 has a severity level of high.

How can I fix CVE-2022-41743?

To fix CVE-2022-41743, upgrade to NGINX Plus versions R27 P1 or R26 P1, which include the necessary security patches.

Where can I find more information about CVE-2022-41743?

You can find more information about CVE-2022-41743 on the F5 support website at the following link: [https://support.f5.com/csp/article/K01112063]

Vulnerability/
CVE-2022-41743

high

CWE

787

19/10/2022

17/9/2024

CVE-2022-41743: NGINX ngx_http_hls_module vulnerability CVE-2022-41743

Q: What is CVE-2022-41743?

CVE-2022-41743 is a vulnerability in NGINX Plus before versions R27 P1 and R26 P1 that allows a local attacker to corrupt NGINX worker memory, resulting in its crash or potential other impact using a specially crafted audio or video file.

First published: Wed Oct 19 2022(Updated: )

NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_hls_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its crash or potential other impact using a specially crafted audio or video file. The issue affects only NGINX Plus when the hls directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_hls_module.

Credit: f5sirt@f5.com

Affected Software	Affected Version	How to fix
F5 NGINX Ingress Controller	>=1.9.0<=1.12.4
F5 NGINX Ingress Controller	>=2.0.0<=2.4.0
F5 NGINX Plus	>=r22<=r27

Never miss a vulnerability like this again

Reference Links

https://support.f5.com/csp/article/K01112063

Frequently Asked Questions

What is CVE-2022-41743?
CVE-2022-41743 is a vulnerability in NGINX Plus before versions R27 P1 and R26 P1 that allows a local attacker to corrupt NGINX worker memory, resulting in its crash or potential other impact using a specially crafted audio or video file.
What software is affected by CVE-2022-41743?
The affected software includes NGINX Plus versions R27 and R26.
What is the severity of CVE-2022-41743?
CVE-2022-41743 has a severity level of high.
How can I fix CVE-2022-41743?
To fix CVE-2022-41743, upgrade to NGINX Plus versions R27 P1 or R26 P1, which include the necessary security patches.
Where can I find more information about CVE-2022-41743?
You can find more information about CVE-2022-41743 on the F5 support website at the following link: [https://support.f5.com/csp/article/K01112063]

agent/type
agent/weakness
agent/references
agent/author
agent/description
collector/nvd-index
agent/software-canonical-lookup-request
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/title
agent/severity
agent/tags
agent/first-publish-date
agent/event
vendor/f5
canonical/f5 nginx ingress controller
version/f5 nginx ingress controller/1.9.0
version/f5 nginx ingress controller/1.12.4
version/f5 nginx ingress controller/2.0.0
version/f5 nginx ingress controller/2.4.0
canonical/f5 nginx plus
version/f5 nginx plus/r22
version/f5 nginx plus/r27

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.