Welcome! Log In Create A New Profile


[nginx-announce] nginx security advisory (CVE-2021-23017)

Posted by Maxim Dounin 

A security issue in nginx resolver was identified, which might allow an
attacker to cause 1-byte memory overwrite by using a specially crafted
DNS response, resulting in worker process crash or, potentially, in
arbitrary code execution (CVE-2021-23017).

The issue only affects nginx if the "resolver" directive is used in
the configuration file. Further, the attack is only possible if an
attacker is able to forge UDP packets from the DNS server.

The issue affects nginx 0.6.18 - 1.20.0.
The issue is fixed in nginx 1.21.0, 1.20.1.

Patch for the issue can be found here:


Thanks to Luis Merino, Markus Vervier, Eric Sesterhenn, X41 D-Sec GmbH.

Maxim Dounin
nginx-announce mailing list
Sorry, you do not have permission to post/reply in this forum.

Online Users

Guests: 105
Record Number of Users: 8 on April 13, 2023
Record Number of Guests: 421 on December 02, 2018
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready