CVE-2017-7529

HIGH severity · CVSS 7.5 · Integer overflow

7.5CVSS HIGH

Summary

Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

Confidentiality impactHigh

Integrity impactNone

Availability impactNone

Exploit probability (EPSS)92%

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products we track (1)

Nginx

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Additional information

NVD record
http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.htmlAdvisory
http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.htmlAdvisory
http://seclists.org/fulldisclosure/2021/Sep/36Advisory
http://www.securityfocus.com/bid/99534Advisory
http://www.securitytracker.com/id/1039238Advisory
https://access.redhat.com/errata/RHSA-2017:2538Advisory
https://puppet.com/security/cve/cve-2017-7529Advisory
https://support.apple.com/kb/HT212818Advisory