CVE-2021-23017CWE-193

CVE-2021-23017: vulnerability in Nginx Web Server, Nginx Plus

Published · Updated

Follow this CVE+ Monitor Nginx Web Server, Nginx Plus+ Monitor nginx

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

40Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 53%
from disclosure to weapon199 days
Published on NVDJun 1
1st PoC+199d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
1 product (10 components)
Red Hat Enterprise Linux 8
no_fix_planned: Will not fix
Fixed
11 products (403 components)
Red Hat Enterprise Linux AppStream (v. 8) · Red Hat Enterprise Linux AppStream EUS (v. 8.1) · Red Hat Enterprise Linux AppStream EUS (v. 8.2) · Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) · Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) · and others 6
fix ↗
Not affected
1 product (11 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 9
A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.
Affected products
n/a · Nginx Web Server, Nginx Plus
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.