CVE-2021-23017
A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cau
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 on Exploit-DB, 9 proofs of concept on GitHub
Summary
A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.
Timeline
- CVE published
- Public exploit on Exploit-DB
EDB-50973
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- n/a Nginx Web Server, Nginx Plus
Version range not reported
References 24
support.f5.com
mailman.nginx.org
lists.apache.org
- thread.html/r6fc5c57b38e93e36213e9a18c8a4e5dbd5ced1c7e57f08a1735975ba@<notifications.apisix.apache.org>
- thread.html/r37e6b2165f7c910d8e15fd54f4697857619ad2625f56583802004009@<notifications.apisix.apache.org>
- thread.html/rf318aeeb4d7a3a312734780b47de83cefb7e6995da0b2cae5c28675c@<notifications.apisix.apache.org>
- thread.html/r4d4966221ca399ce948ef34884652265729d7d9ef8179c78d7f17e7f@<notifications.apisix.apache.org>
- thread.html/rf232eecd47fdc44520192810560303073cefd684b321f85e311bad31@<notifications.apisix.apache.org>