[GLSA-202105-38] nginx: Remote code execution

Severity High

Affected Packages 1

Unaffected Packages 2

CVEs 1

A vulnerability in nginx could lead to remote code execution.

Background
nginx is a robust, small, and high performance HTTP and reverse proxy
server.

Description
It was discovered that nginx did not properly handle DNS responses when
“resolver” directive is used.

Impact
A remote attacker, able to provide DNS responses to a nginx instance,
could cause the execution of arbitrary code with the privileges of the
process or a Denial of Service condition.

Workaround
There is no known workaround at this time.

Resolution
All nginx users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=www-servers/nginx-1.20.1"

All nginx mainline users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose
">=www-servers/nginx-1.21.0:mainline"

Package	Affected Version
pkg:ebuild/www-servers/nginx?distro=gentoo	< 1.21.0

Package	Unaffected Version
pkg:ebuild/www-servers/nginx?distro=gentoo	>= 1.20.1
pkg:ebuild/www-servers/nginx?distro=gentoo	>= 1.21.0

ID

GLSA-202105-38

Severity

high

URL

https://security.gentoo.org/glsa/202105-38

Published

2021-05-26T00:00:00
(3 years ago)

Modified

2021-05-26T00:00:00
(3 years ago)

Rights

Gentoo Foundation, Inc.

Other Advisories

Source	# ID	Name	URL
CVE	CVE-2021-23017	CVE-2021-23017	https://nvd.nist.gov/vuln/detail/CVE-2021-23017
Bugzilla	792087	Bugzilla #792087	https://bugs.gentoo.org/show_bug.cgi?id=792087

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform
Affected	pkg:ebuild/www-servers/nginx?distro=gentoo	www-servers	nginx	< 1.21.0	gentoo
Unaffected	pkg:ebuild/www-servers/nginx?distro=gentoo	www-servers	nginx	>= 1.20.1	gentoo
Unaffected	pkg:ebuild/www-servers/nginx?distro=gentoo	www-servers	nginx	>= 1.21.0	gentoo

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date