[NGINX:CVE-2022-41741] Memory corruption in the ngx_http_mp4_module

Severity Medium

Affected Packages 2

Unaffected Packages 2

CVEs 1

NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its termination or potential other impact using a specially crafted audio or video file. The issue affects only NGINX products that are built with the ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_mp4_module.

Package	Affected Version
pkg:nginx/nginx	>= 1.1.3, <= 1.23.1
pkg:nginx/nginx	>= 1.0.7, <= 1.0.15

Package	Unaffected Version
pkg:nginx/nginx	>= 1.23.2
pkg:nginx/nginx	>= 1.22.1

ID

NGINX:CVE-2022-41741

Severity

medium

Published

2022-10-19T22:15:12
(23 months ago)

Modified

2022-10-19T22:15:12
(23 months ago)

Rights

NGINX Security Team

Other Advisories

Type	Package URL	Name / Product	Version
Affected	pkg:nginx/nginx	nginx	>= 1.1.3 <= 1.23.1
Affected	pkg:nginx/nginx	nginx	>= 1.0.7 <= 1.0.15
Unaffected	pkg:nginx/nginx	nginx	>= 1.23.2
Unaffected	pkg:nginx/nginx	nginx	>= 1.22.1

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date