CVE-2009-2629
Published · Updated
67Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.
ssvc Actepss 75%
from disclosure to weapon348 days
Published on NVDSep 15
1st PoC+348d
VulnCheck+581d
exploitation probability
75%top 1% of all CVEs
observed exploitation
yesVulnCheck
1 public exploit(s)
What the vendors declare (VEX)
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Red HatVEX document ↗
Not affected
1 product — because the vulnerable code is not present in the product
red_hat_products
Buffer underflow in src/http/ngx_http_parse.c in nginx 0.1.0 through 0.5.37, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.15 allows remote attackers to execute arbitrary code via crafted HTTP requests.
Affected products
n/a · n/apublic PoCs found — 1✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/14830⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://nginx.net/CHANGEShttp://nginx.net/CHANGES-0.5http://nginx.net/CHANGES-0.6http://nginx.net/CHANGES-0.7https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00428.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-December/msg00442.htmlhttps://www.redhat.com/archives/fedora-package-announce/2009-December/msg00449.htmlhttp://sysoev.ru/nginx/patch.180065.txthttp://www.debian.org/security/2009/dsa-1884http://www.kb.cert.org/vuls/id/180065