Vulnerability Name:

CVE-2017-7529 (CCN-128674)

Assigned:2017-07-11
Published:2017-07-11
Updated:2022-01-24
Summary:Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.
CVSS v3 Severity:7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
6.5 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): None
Availibility (A): None
5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
4.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-190
Vulnerability Consequences:Obtain Information
References:Source: MITRE
Type: CNA
CVE-2017-7529

Source: CCN
Type: nginx Mailing List, Tue Jul 11 15:48:23 UTC 2017
nginx security advisory (CVE-2017-7529)

Source: MLIST
Type: Vendor Advisory
[nginx-announce] 20170711 nginx security advisory (CVE-2017-7529)

Source: CCN
Type: Nginx Web site
nginx news

Source: FULLDISC
Type: Mailing List, Third Party Advisory
20210921 APPLE-SA-2021-09-20-4 Xcode 13

Source: CCN
Type: IBM Security Bulletin T1026033 (PowerKVM)
A vulnerability in nginx affects PowerKVM

Source: CCN
Type: IBM Security Bulletin 2011149 (Aspera)
Aspera Applications are affected by a Nginx vulnerability

Source: BID
Type: Third Party Advisory, VDB Entry
99534

Source: CCN
Type: BID-99534
Nginx CVE-2017-7529 Remote Integer Overflow Vulnerability

Source: SECTRACK
Type: Third Party Advisory, VDB Entry
1039238

Source: REDHAT
Type: Third Party Advisory
RHSA-2017:2538

Source: XF
Type: UNKNOWN
nginx-cve20177529-info-disc(128674)

Source: CONFIRM
Type: Third Party Advisory
https://puppet.com/security/cve/cve-2017-7529

Source: CCN
Type: Apple security document HT212818
About the security content of Xcode 13

Source: CONFIRM
Type: Third Party Advisory
https://support.apple.com/kb/HT212818

Vulnerable Configuration:Configuration 1:
  • cpe:/a:f5:nginx:*:*:*:*:*:*:*:* (Version >= 0.5.6 and <= 1.12.1)
  • OR cpe:/a:f5:nginx:*:*:*:*:*:*:*:* (Version >= 1.13.0 and <= 1.13.2)

    • Configuration 2:
  • cpe:/a:puppet:puppet_enterprise:*:*:*:*:*:*:*:* (Version >= 2017.1.0 and <= 2017.1.1)
  • OR cpe:/a:puppet:puppet_enterprise:*:*:*:*:*:*:*:* (Version >= 2017.2.1 and <= 2017.2.3)
  • OR cpe:/a:puppet:puppet_enterprise:*:*:*:*:*:*:*:* (Version < 2016.4.7)

    • Configuration 3:
  • cpe:/a:apple:xcode:*:*:*:*:*:*:*:* (Version < 13.0)

    • Configuration CCN 1:
  • cpe:/a:nginx:nginx:0.5.6:*:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:powerkvm:3.1:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:aspera:*:*:*:*:*:*:*:*
  • OR cpe:/a:apple:xcode:12.3:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:608
    P
    		Security update for clone-master-clean-up (Moderate) (in QA)
    2022-09-26
    oval:org.opensuse.security:def:20177529
    V
    		CVE-2017-7529
    2022-09-02
    oval:org.opensuse.security:def:3508
    P
    		gpg2-2.0.24-9.8.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:95138
    P
    		nginx-1.21.5-150400.1.8 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:1527
    P
    		Security update for containerd, docker and runc (Important) (in QA)
    2022-06-14
    oval:org.opensuse.security:def:94230
    P
    		 (Important)
    2022-05-03
    oval:org.opensuse.security:def:1059
    P
    		Security update for libexif (Important)
    2022-04-11
    oval:org.opensuse.security:def:1581
    P
    		Security update for python (Moderate)
    2022-04-01
    oval:org.opensuse.security:def:113396
    P
    		ruby2.7-rubygem-passenger-6.0.8-3.2 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:113031
    P
    		nginx-1.21.3-1.4 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:106801
    P
    		Security update for libsndfile (Important)
    2022-01-11
    oval:org.opensuse.security:def:106474
    P
    		Security update for p11-kit (Important)
    2021-12-22
    oval:org.opensuse.security:def:68081
    P
    		Security update for the Linux Kernel (Live Patch 26 for SLE 15 SP1) (Important)
    2021-11-17
    oval:org.opensuse.security:def:1643
    P
    		Security update for libvirt (Moderate)
    2021-11-05
    oval:org.opensuse.security:def:71321
    P
    		libtag1-1.11.1-2.50 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:90061
    P
    		nginx-1.14.0-4.24 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:2137
    P
    		nginx-1.14.0-4.24 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:63226
    P
    		nginx-1.14.0-4.24 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:103716
    P
    		nginx-1.14.0-4.24 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:97026
    P
    		nginx-1.14.0-4.24 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:66899
    P
    		Security update for aspell (Important)
    2021-08-20
    oval:org.opensuse.security:def:47987
    P
    		cyrus-sasl-2.1.26-8.7.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47526
    P
    		wget-1.14-20.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:48133
    P
    		libjbig2-2.0-12.13 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47855
    P
    		perl-YAML-LibYAML-0.38-10.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:48041
    P
    		hardlink-1.0-6.38 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47662
    P
    		libFLAC++6-1.3.0-11.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47580
    P
    		cracklib-2.9.0-7.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47909
    P
    		unixODBC-2.3.6-7.9.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47541
    P
    		yast2-users-3.2.11-1.47 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47716
    P
    		libhivex0-1.3.10-4.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47527
    P
    		wpa_supplicant-2.2-14.2 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:48227
    P
    		libxml2-2-2.9.4-46.20.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47595
    P
    		dosfstools-3.0.26-6.5 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:48079
    P
    		libXi6-1.7.4-18.6.1 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:47581
    P
    		crash-7.2.1-2.19 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:48281
    P
    		python-cupshelpers-1.5.7-7.5 on GA media (Moderate)
    2021-08-16
    oval:org.opensuse.security:def:101384
    P
    		nginx-1.19.8-1.1 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:2269
    P
    		nginx-1.19.8-1.1 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:63358
    P
    		nginx-1.19.8-1.1 on GA media (Moderate)
    2021-08-10
    oval:org.opensuse.security:def:100943
    P
    		libnm0-1.22.10-3.7.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:1005
    P
    		gssproxy-0.8.2-3.6.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:64734
    P
    		Security update for curl (Moderate)
    2021-07-21
    oval:org.opensuse.security:def:48706
    P
    		telepathy-gabble-0.18.1-3.268 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48641
    P
    		vino-3.20.2-5.8 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48525
    P
    		libmusicbrainz4-2.1.5-27.79 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48754
    P
    		pulseaudio-module-bluetooth-5.0-2.7 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48441
    P
    		gvim-7.4.326-2.14 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48683
    P
    		libgio-fam-2.38.2-5.12 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48579
    P
    		mutt-1.6.0-54.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48808
    P
    		libwebkit2gtk-3_0-25-2.4.8-16.2 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48652
    P
    		xlockmore-5.43-5.30 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48495
    P
    		libgcrypt20-1.6.1-16.33.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48737
    P
    		libmikmod3-3.2.0-4.59 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:48587
    P
    		p7zip-9.20.1-6.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:66807
    P
    		Security update for avahi (Important)
    2021-06-03
    oval:org.opensuse.security:def:67981
    P
    		Security update for the Linux Kernel (Live Patch 23 for SLE 15 SP1) (Important)
    2021-04-28
    oval:org.opensuse.security:def:73590
    P
    		Security update for wpa_supplicant (Moderate)
    2021-04-13
    oval:org.opensuse.security:def:64647
    P
    		Security update for screen (Important)
    2021-02-17
    oval:org.opensuse.security:def:70255
    P
    		Security update for nodejs8 (Moderate)
    2021-01-26
    oval:org.opensuse.security:def:63172
    P
    		nginx-1.14.0-1.14 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:117167
    P
    		nginx-1.16.1-1.21 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:2199
    P
    		nginx-1.16.1-1.21 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:63288
    P
    		nginx-1.16.1-1.21 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:107609
    P
    		nginx-1.16.1-1.21 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:71434
    P
    		apache-commons-httpclient-3.1-9.65 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:2083
    P
    		nginx-1.14.0-1.14 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:49968
    P
    		nginx on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25045
    P
    		Security update for libcaca (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25597
    P
    		Security update for squid (Critical)
    2020-12-01
    oval:org.opensuse.security:def:24981
    P
    		Security update for bzip2 (Important)
    2020-12-01
    oval:org.opensuse.security:def:25743
    P
    		Security update for libssh (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:24970
    P
    		Security update for glib2 (Important)
    2020-12-01
    oval:org.opensuse.security:def:25544
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:26416
    P
    		Security update for nginx (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50030
    P
    		rmt-server on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:73472
    P
    		sane-backends on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25699
    P
    		Security update for dnsmasq (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25394
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:70150
    P
    		blktrace on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25685
    P
    		Security update for mariadb (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50022
    P
    		nginx on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25310
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:26381
    P
    		Security update for ffmpeg (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25253
    P
    		Security update for tomcat (Important)
    2020-12-01
    oval:org.opensuse.security:def:49914
    P
    		mercurial on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:50084
    P
    		nginx on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25172
    P
    		Security update for bind (Important)
    2020-12-01
    oval:com.ubuntu.trusty:def:20177529000
    V
    		CVE-2017-7529 on Ubuntu 14.04 LTS (trusty) - medium.
    2017-07-13
    oval:com.ubuntu.xenial:def:20177529000
    V
    		CVE-2017-7529 on Ubuntu 16.04 LTS (xenial) - medium.
    2017-07-13
    oval:com.ubuntu.xenial:def:201775290000000
    V
    		CVE-2017-7529 on Ubuntu 16.04 LTS (xenial) - medium.
    2017-07-13
    BACK
    f5 nginx *
    f5 nginx *
    puppet puppet enterprise *
    puppet puppet enterprise *
    puppet puppet enterprise *
    apple xcode *
    nginx nginx 0.5.6
    ibm powerkvm 3.1
    ibm aspera *
    apple xcode 12.3