REDHAT-BUG-2489866: Buffer Overflow
NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpproxyv2module and ngxhttpgrpcmodule modules. This vulnerability exists when the proxyhttpversion to 2 or grpcpass directives are used to proxy HTTP/2 traffic, the ignoreinvalidheaders directive is set to off, and the largeclientheaderbuffers directive size is larger than 2 megabytes. A remote, unauthenticated attacker, along with conditions beyond their control, could send large headers while creating an upstream request. This may cause a heap-based buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set the ignore_invalid_headers directive to on (the vulnerability is present when ignore_invalid_headers is set to off).
NGINX (ngx_http_proxy_v2_module / ngx_http_grpc_module) ignore_invalid_headers = on - Configuration
Reduce the large_client_header_buffers directive size to 2 megabytes or less (the vulnerability exists when large_client_header_buffers is larger than 2 megabytes).
NGINX (ngx_http_proxy_v2_module / ngx_http_grpc_module) large_client_header_buffers = <= 2 megabytes - Configuration
Avoid using proxy_http_version to 2 when proxying HTTP/2 traffic through ngx_http_proxy_v2_module (the vulnerability exists when proxy_http_version to 2 is used).
NGINX (ngx_http_proxy_v2_module / ngx_http_grpc_module) proxy_http_version = not 2 - Configuration
Avoid using grpc_pass to proxy HTTP/2 traffic through ngx_http_grpc_module (the vulnerability exists when grpc_pass is used to proxy HTTP/2 traffic).
NGINX (ngx_http_grpc_module) grpc_pass = do not proxy HTTP/2 via grpc_pass - Compensating control
If you cannot change configuration immediately, ensure ASLR is enabled on systems running NGINX (attackers could execute code when ASLR is disabled or bypassed).
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2489866?
The severity of REDHAT-BUG-2489866 is high, rated at 7.
How do I fix REDHAT-BUG-2489866?
To fix REDHAT-BUG-2489866, ensure that the proxy_http_version is not set to 2 and adjust the configuration to avoid the use of grpc_pass with the ignore_invalid_headers directive set to off.
What modules are affected by REDHAT-BUG-2489866?
The modules affected by REDHAT-BUG-2489866 are ngx_http_proxy_v2_module and ngx_http_grpc_module.
What type of vulnerability is REDHAT-BUG-2489866?
REDHAT-BUG-2489866 is a buffer overflow vulnerability.
In which software is REDHAT-BUG-2489866 found?
REDHAT-BUG-2489866 is found in Nginx NGINX Plus and Nginx NGINX Open Source.