CVE-2019-20372

🗓️ 09 Jan 2020 20:05:38Reported by mitreType

NGINX version before 1.17.7 allows HTTP request smuggling with certain error_page configurations

Reporter	Title	Published	Views	Family All 112
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Node.js, Golang Go, HTTP/2, NGINX, OpenSSH, Linux kernel might affect IBM Spectrum Protect Plus	4 Feb 202518:15	–	ibm
IBM Security Bulletins	Security Bulletin: Spectrum Discover has addressed multiple security vulnerabilities (CVE-2020-13401, CVE-2019-20372)	13 May 202116:54	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in middleware software affect IBM Cloud Pak for Automation	27 Jun 202009:38	–	ibm
IBM Security Bulletins	Security Bulletin: A Security Vulnerability affects IBM Cloud Private - NGINX (CVE-2019-20372)	21 Apr 202219:06	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insight v1.6.8 addresses multiple security vulnerabilities.	11 Apr 202311:47	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Cloud Private for Data V2.1.0 NGINX (CVE-2019-12206, CVE-2019-12207, CVE-2019-12208, CVE-2019-20372), Docker (CVE-2019-17149, CVE-2019-17150), Kubernetes (CVE-2019-11245, CVE-2019-11253, CVE-2019-1022	6 Mar 202020:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM StoredIQ is affected by a vulnerability in NGINX (CVE-2019-20372)	10 Jul 202014:39	–	ibm
IBM Security Bulletins	Security Bulletin: NGINX vulnerability CVE-2019-20372 impacts IBM Aspera High-Speed Transfer Server and Aspera High-Speed Transfer Endpoint versions prior to V4.0	10 Dec 202022:20	–	ibm
IBM Security Bulletins	Security Bulletin: IBM API Connect is impacted by a vulnerability in NGINX (CVE-2019-20372)	11 May 202017:53	–	ibm
GithubExploit	Exploit for HTTP Request Smuggling in F5 Nginx	16 Sep 202319:47	–	githubexploit

NVD

Node

f5 nginxRange<1.17.7

Node

apple xcodeRange<13.0

Node

canonical ubuntu_linuxMatch14.04esm

Node

opensuse leapMatch15.1

Node

netapp cloud_backupMatch-

Source	Link
nginx	www.nginx.org/en/CHANGES
github	www.github.com/nginx/nginx/commit/c1be55f97211d38b69ac0c2027e6812ab8b1b94e
seclists	www.seclists.org/fulldisclosure/2021/Sep/36
bertjwregeer	www.bertjwregeer.keybase.pub/2019-12-10%20-%20error_page%20request%20smuggling.pdf
github	www.github.com/kubernetes/ingress-nginx/pull/4859
usn	www.usn.ubuntu.com/4235-2/
security	www.security.netapp.com/advisory/ntap-20200127-0003/
support	www.support.apple.com/kb/HT212818
usn	www.usn.ubuntu.com/4235-1/
lists	www.lists.opensuse.org/opensuse-security-announce/2020-02/msg00013.html

21 Nov 2024 04:38Current

5.2Medium risk

Vulners AI Score5.2

CVSS 24.3

CVSS 3.15.3

EPSS0.69569

CWE-444