| Vulnerability Name: | CVE-2017-20005 (CCN-203963) | ||||||||||||
| Assigned: | 2017-09-13 | ||||||||||||
| Published: | 2017-09-13 | ||||||||||||
| Updated: | 2021-12-02 | ||||||||||||
| Summary: | NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modification date in 1969 that causes an integer overflow (or a false modification date far in the future), when encountered by the autoindex module. | ||||||||||||
| CVSS v3 Severity: | 9.8 Critical (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) 8.5 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
8.5 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
| ||||||||||||
| CVSS v2 Severity: | 7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
| ||||||||||||
| Vulnerability Type: | CWE-190 | ||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||
| References: | Source: MITRE Type: CNA CVE-2017-20005 Source: MISC Type: Release Notes, Vendor Advisory http://nginx.org/en/CHANGES Source: XF Type: UNKNOWN gninx-cve201720005-bo(203963) Source: MISC Type: Patch, Third Party Advisory https://github.com/nginx/nginx/commit/0206ebe76f748bb39d9de4dd4b3fce777fdfdccf Source: CCN Type: NGINX GIT Repository NGINX Source: MISC Type: Patch, Third Party Advisory https://github.com/nginx/nginx/commit/b900cc28fcbb4cf5a32ab62f80b59292e1c85b4b Source: MLIST Type: Mailing List, Third Party Advisory [debian-lts-announce] 20210607 [SECURITY] [DLA 2680-1] nginx security update Source: CONFIRM Type: Third Party Advisory https://security.netapp.com/advisory/ntap-20210805-0006/ Source: MISC Type: Exploit, Patch, Vendor Advisory https://trac.nginx.org/nginx/ticket/1368 | ||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration 2: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||
| BACK | |||||||||||||