{"containers": {"cna": {"affected": [{"product": "nginx", "vendor": "nginx", "versions": [{"status": "affected", "version": "0.5.6 - 1.13.2"}]}], "datePublic": "2017-07-11T00:00:00", "descriptions": [{"lang": "en", "value": "Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-190", "description": "CWE-190", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-09-21T23:07:12", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"name": "[nginx-announce] 20170711 nginx security advisory (CVE-2017-7529)", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.html"}, {"name": "RHSA-2017:2538", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2017:2538"}, {"name": "99534", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/99534"}, {"name": "1039238", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1039238"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://puppet.com/security/cve/cve-2017-7529"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://support.apple.com/kb/HT212818"}, {"name": "20210921 APPLE-SA-2021-09-20-4 Xcode 13", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://seclists.org/fulldisclosure/2021/Sep/36"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert@redhat.com", "DATE_PUBLIC": "2017-07-11T00:00:00", "ID": "CVE-2017-7529", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "nginx", "version": {"version_data": [{"version_value": "0.5.6 - 1.13.2"}]}}]}, "vendor_name": "nginx"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-190"}]}]}, "references": {"reference_data": [{"name": "[nginx-announce] 20170711 nginx security advisory (CVE-2017-7529)", "refsource": "MLIST", "url": "http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.html"}, {"name": "RHSA-2017:2538", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2017:2538"}, {"name": "99534", "refsource": "BID", "url": "http://www.securityfocus.com/bid/99534"}, {"name": "1039238", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1039238"}, {"name": "https://puppet.com/security/cve/cve-2017-7529", "refsource": "CONFIRM", "url": "https://puppet.com/security/cve/cve-2017-7529"}, {"name": "https://support.apple.com/kb/HT212818", "refsource": "CONFIRM", "url": "https://support.apple.com/kb/HT212818"}, {"name": "20210921 APPLE-SA-2021-09-20-4 Xcode 13", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2021/Sep/36"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T16:04:11.898Z"}, "title": "CVE Program Container", "references": [{"name": "[nginx-announce] 20170711 nginx security advisory (CVE-2017-7529)", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.html"}, {"name": "RHSA-2017:2538", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2017:2538"}, {"name": "99534", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/99534"}, {"name": "1039238", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1039238"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://puppet.com/security/cve/cve-2017-7529"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://support.apple.com/kb/HT212818"}, {"name": "20210921 APPLE-SA-2021-09-20-4 Xcode 13", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://seclists.org/fulldisclosure/2021/Sep/36"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2017-7529", "datePublished": "2017-07-13T13:00:00Z", "dateReserved": "2017-04-05T00:00:00", "dateUpdated": "2024-09-16T18:39:56.411Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*", "matchCriteriaId": "D19034A4-1211-4A40-A2D3-2A9F87770081", "versionEndIncluding": "1.12.1", "versionStartIncluding": "0.5.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*", "matchCriteriaId": "BA59CB1C-4A69-4593-9D22-9B45FCA70490", "versionEndIncluding": "1.13.2", "versionStartIncluding": "1.13.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*", "matchCriteriaId": "B7ABD977-A333-473B-806D-32ECD7909B35", "versionEndExcluding": "2016.4.7", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*", "matchCriteriaId": "15CC6F3C-8DA8-4CE0-8E9A-057A0F55DEE4", "versionEndIncluding": "2017.1.1", "versionStartIncluding": "2017.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*", "matchCriteriaId": "38CBF065-5219-463A-9677-86088D761584", "versionEndIncluding": "2017.2.3", "versionStartIncluding": "2017.2.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*", "matchCriteriaId": "BB279F6B-EE4C-4885-9CD4-657F6BD2548F", "versionEndExcluding": "13.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request."}, {"lang": "es", "value": "Las versiones desde la 0.5.6 hasta 1.13.2 incluy\u00e9ndola de Nginx, son susceptibles a una vulnerabilidad de desbordamiento de enteros en el m\u00f3dulo filtro de rango de nginx, resultando en un filtrado de informaci\u00f3n potencialmente confidencial activada por una petici\u00f3n especialmente creada."}], "id": "CVE-2017-7529", "lastModified": "2024-11-21T03:32:05.337", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-07-13T13:29:00.220", "references": [{"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.html"}, {"source": "secalert@redhat.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2021/Sep/36"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/99534"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1039238"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2017:2538"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://puppet.com/security/cve/cve-2017-7529"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://support.apple.com/kb/HT212818"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2021/Sep/36"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/99534"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1039238"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2017:2538"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://puppet.com/security/cve/cve-2017-7529"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://support.apple.com/kb/HT212818"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "secalert@redhat.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-190"}], "source": "nvd@nist.gov", "type": "Secondary"}]}

{"acknowledgement": "Red Hat would like to thank the Nginx project for reporting this issue.", "affected_release": [{"advisory": "RHSA-2017:2538", "cpe": "cpe:/a:redhat:rhel_software_collections:2::el6", "package": "rh-nginx110-nginx-1:1.10.2-8.el6", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 6", "release_date": "2017-08-28T00:00:00Z"}, {"advisory": "RHSA-2017:2538", "cpe": "cpe:/a:redhat:rhel_software_collections:2::el6", "package": "rh-nginx110-nginx-1:1.10.2-8.el6", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUS", "release_date": "2017-08-28T00:00:00Z"}, {"advisory": "RHSA-2017:2538", "cpe": "cpe:/a:redhat:rhel_software_collections:2::el7", "package": "rh-nginx110-nginx-1:1.10.2-8.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7", "release_date": "2017-08-28T00:00:00Z"}, {"advisory": "RHSA-2017:2538", "cpe": "cpe:/a:redhat:rhel_software_collections:2::el7", "package": "rh-nginx110-nginx-1:1.10.2-8.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7.3 EUS", "release_date": "2017-08-28T00:00:00Z"}], "bugzilla": {"description": "nginx: Integer overflow in nginx range filter module leading to memory disclosure", "id": "1468584", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1468584"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "verified"}, "cwe": "CWE-190", "details": ["Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.", "A flaw within the processing of ranged HTTP requests has been discovered in the range filter module of nginx. A remote attacker could possibly exploit this flaw to disclose parts of the cache file header, or, if used in combination with third party modules, disclose potentially sensitive memory by sending specially crafted HTTP requests."], "name": "CVE-2017-7529", "package_state": [{"cpe": "cpe:/a:redhat:rhel_software_collections:2", "fix_state": "Not affected", "package_name": "rh-nginx112-nginx", "product_name": "Red Hat Software Collections"}, {"cpe": "cpe:/a:redhat:rhel_software_collections:2", "fix_state": "Will not fix", "package_name": "rh-nginx18-nginx", "product_name": "Red Hat Software Collections"}], "public_date": "2017-07-11T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2017-7529\nhttps://nvd.nist.gov/vuln/detail/CVE-2017-7529\nhttp://mailman.nginx.org/pipermail/nginx-announce/2017/000200.html"], "statement": "Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.", "threat_severity": "Low", "upstream_fix": "nginx 1.13.3, nginx 1.12.1"}