CVE-2024-7347

CWE-126 — Buffer Over-readCWE-125 — Out-of-bounds Read12 documents10 sources
Severity
5.7MEDIUM
EPSS
0.2%
top 57.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
F5 Nginx Open SourceF5 Nginx Plus
Timeline
PublishedAug 14
Latest updateOct 14

Description

NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with the ngx_http_mp4_module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted mp4 file with the ngx_http_mp4_module. Note: Softwar…

CVSS vector

CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected Packages5 packages

▶CVEListV5f5/nginx_open_source1.5.13 — *
▶NVDf5/nginx_open_source1.5.13 — 1.26.2+1
▶CVEListV5f5/nginx_plusR4 — *
▶NVDf5/nginx_plusr27 — r31+2
▶Debiannginx< 1.18.0-6.1+deb11u4+3

🔴Vulnerability Details

3
OSV
CVE-2024-7347: NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to over-read NGINX worker memory resul↗2024-08-14
▶
CVEList
NGINX MP4 module vulnerability↗2024-08-14
▶
GHSA
GHSA-3r23-64c4-mj87: NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to over-read NGINX worker memory resul↗2024-08-14
▶

📋Vendor Advisories

7
Ubuntu
nginx vulnerability↗2024-10-14
▶
Ubuntu
nginx vulnerability↗2024-10-08
▶
Ubuntu
nginx vulnerability↗2024-09-16
▶
Red Hat
nginx: specially crafted MP4 file may cause denial of service↗2024-08-14
▶
F5
CVE-2024-7347: NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to ov...↗2024-08-14
▶

💬Community

1
HackerOne
CVE-2024-7347: Buffer overread in the ngx_http_mp4_module↗2024-08-27
▶