7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
0.963 High
EPSS
Percentile
99.5%
Severity: High
Date : 2017-07-12
CVE-ID : CVE-2017-7529
Package : nginx
Type : information disclosure
Remote : Yes
Link : https://security.archlinux.org/AVG-345
The package nginx before version 1.12.1-1 is vulnerable to information
disclosure.
Upgrade to 1.12.1-1.
The problem has been fixed upstream in version 1.12.1.
None.
A security issue was identified in the range filter module of nginx <
1.13.3. A specially crafted request might result in an integer overflow
and incorrect processing of ranges, potentially resulting in sensitive
information leak.
When using nginx with standard modules this allows an attacker to
obtain a cache file header if a response was returned from cache. In
some configurations a cache file header may contain IP address of the
backend server or other sensitive information. Besides, with 3rd party
modules it is potentially possible that the issue may lead to a denial
of service or a disclosure of a worker process memory. No such modules
are currently known though.
A remote attacker can access sensitive information by sending a
specially crafted request.
http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.html
https://nginx.org/download/patch.2017.ranges.txt
https://security.archlinux.org/CVE-2017-7529
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
0.963 High
EPSS
Percentile
99.5%