REDHAT-BUG-2141495: Medium severity Nginx Open Source vulnerability

Published Nov 10, 2022
·
Updated

NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngxhttpmp4module that might allow a local attacker to corrupt NGINX worker memory, resulting in its termination or potential other impact using a specially crafted audio or video file. The issue affects only NGINX products that are built with the ngxhttpmp4module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngxhttpmp4module.

https://nginx.org/en/securityadvisories.html

Affected Software

3 affected components
Nginx Open Source<1.23.2, <1.22.1
Nginx Open Source Subscription<R2 P1, <R1 P1
Nginx Plus<R27 P1, <R26 P1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade nginx/nginx to a version that resolves this vulnerability.

    Fixed in 1.23.2
  2. Upgrade

    Upgrade nginx/nginx to a version that resolves this vulnerability.

    Fixed in 1.22.1
  3. Upgrade

    Upgrade nginx/nginx-open-source-subscription to a version that resolves this vulnerability.

    Patch R2 P1
  4. Upgrade

    Upgrade nginx/nginx-open-source-subscription to a version that resolves this vulnerability.

    Patch R1 P1
  5. Upgrade

    Upgrade nginx/nginx-plus to a version that resolves this vulnerability.

    Patch R27 P1
  6. Upgrade

    Upgrade nginx/nginx-plus to a version that resolves this vulnerability.

    Patch R26 P1
  7. Configuration

    Ensure the NGINX configuration does not use the mp4 directive (avoid enabling ngx_http_mp4_module usage in configurations where possible), since the vulnerability is triggered only when processing a specially crafted audio/video file through this module.

    nginx ngx_http_mp4_module mp4 directive = not used

Event History

Nov 10, 2022
Data Sourced
via Red Hat·04:51 AM
DescriptionSeverityAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of REDHAT-BUG-2141495?

The severity of REDHAT-BUG-2141495 is high due to its potential impact on NGINX worker memory corruption.

2

How do I fix REDHAT-BUG-2141495?

To fix REDHAT-BUG-2141495, upgrade to NGINX Open Source version 1.23.2 or 1.22.1, or to the respective updates of NGINX Plus.

3

Which versions of NGINX are affected by REDHAT-BUG-2141495?

REDHAT-BUG-2141495 affects NGINX Open Source versions prior to 1.23.2 and 1.22.1, as well as certain versions of NGINX Plus and Subscription.

4

Can a local attacker exploit REDHAT-BUG-2141495?

Yes, a local attacker may exploit REDHAT-BUG-2141495 to corrupt NGINX worker memory.

5

What components of NGINX are impacted by REDHAT-BUG-2141495?

REDHAT-BUG-2141495 specifically impacts the ngx_http_mp4_module within NGINX.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203
REDHAT-BUG-2141495 - Medium severity Nginx Open Source vulnerability - SecAlerts