CVE-2023-45132 IgnoreIP/IgnoreCIDR should not trust X-Forwarded-For

NAXSI is an open-source maintenance web application firewall WAF for NGINX. An issue present starting in version 1.3 and prior to version 1.6 allows someone to bypass the WAF when a malicious X-Forwarded-For IP matches IgnoreIP IgnoreCIDR rules. This old code was arranged to allow older NGINX...

CVE-2023-45132

CVE-2023-45132 affects the NAXSI WAF for NGINX. The issue, present from 1.3 up to but not including 1.6, allows bypassing the WAF when a crafted X-Forwarded-For IP matches IgnoreIP/IgnoreCIDR rules. The root cause is how IgnoreIP/IgnoreCIDR were supported with multiple reverse proxies, enabling b...

CVE-2023-45132 IgnoreIP/IgnoreCIDR should not trust X-Forwarded-For

NAXSI is an open-source maintenance web application firewall WAF for NGINX. An issue present starting in version 1.3 and prior to version 1.6 allows someone to bypass the WAF when a malicious X-Forwarded-For IP matches IgnoreIP IgnoreCIDR rules. This old code was arranged to allow older NGINX...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: kubescape, flux-notification-controller, kubernetes-csi-livenessprobe-fips, aws-efs-csi-driver, terraform-provider-azurerm, kubernetes-csi-livenessprobe, nfs-subdir-external-provisioner-fips, pulumi, envoy-ratelimit, tomcat, grype, prometheus-elasticsearch-exporter,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: rqlite, weaviate, flux-source-controller, kind, dgraph, gitness, pulumi-language-yaml, newrelic-infrastructure-agent, frp, haproxy-ingress, metacontroller, prometheus-blackbox-exporter, ip-masq-agent, gobuster, ollama, bom, nginx-stable, cue, kaf, cortex, oauth2-prox...

CVE-2023-44487

A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RSTSTREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any...

AZL-31333 CVE-2023-44487 affecting package nginx for versions less than 1.22.1-11

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

AZL-35028 CVE-2023-44487 affecting package nginx for versions less than 1.25.4-1

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

CVE-2023-44487 vulnerabilities

Vulnerabilities for packages: rqlite, weaviate, flux-source-controller, kind, dgraph, gitness, pulumi-language-yaml, newrelic-infrastructure-agent, frp, haproxy-ingress, metacontroller, prometheus-blackbox-exporter, ip-masq-agent, gobuster, ollama, bom, nginx-stable, cue, kaf, cortex, oauth2-prox...

K000137106: HTTP/2 vulnerability CVE-2023-44487

Security Advisory Description The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. CVE-2023-44487 also known as HTTP/2 Rapid Reset Attack Impact BIG-IP and...

K000135944: Attack signature check security exposure

Security Advisory Description BIG-IP Advanced WAF, BIG-IP ASM, and NGINX App Protect systems incorrectly handle certain requests. This issue occurs when the following condition is met: BIG-IP Advanced WAF, BIG-IP ASM, and NGINX App Protect handle a crafted request with the parameter value. Impact...

CVE-2023-44487

The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023...

Amazon Linux 2 : nginx (ALASNGINX1-2023-001)

The version of nginx installed on the remote host is prior to 1.22.1-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NGINX1-2023-001 advisory. NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, a...

Amazon Linux 2 : nginx (ALASNGINX1-2023-005)

The version of nginx installed on the remote host is prior to 1.20.0-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2NGINX1-2023-005 advisory. The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, befor...

Amazon Linux 2 : nginx (ALASNGINX1-2023-003)

The version of nginx installed on the remote host is prior to 1.20.0-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2NGINX1-2023-003 advisory. A flaw was found in nginx. An off-by-one error while processing DNS responses allows a network attacker to write a dot characte...

Amazon Linux 2 : nginx (ALASNGINX1-2023-002)

The version of nginx installed on the remote host is prior to 1.20.0-2. It is, therefore, affected by a vulnerability as referenced in the ALAS2NGINX1-2023-002 advisory. ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but...

Amazon Linux 2 : nginx (ALASNGINX1-2023-004)

The version of nginx installed on the remote host is prior to 1.18.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NGINX1-2023-004 advisory. NGINX before 1.17.7, with certain errorpage configurations, allows HTTP request smuggling, as demonstrated by the ability of an...

openSUSE 15 Security Update : modsecurity (openSUSE-SU-2023:0257-1)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0257-1 advisory. - DISPUTED Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. NOTE: The discoverer reports Trustwave has...

Important: nginx

Issue Overview: A flaw was found in nginx. An off-by-one error while processing DNS responses allows a network attacker to write a dot character out of bounds in a heap allocated buffer which can allow overwriting the least significant byte of next heap chunk metadata likely leading to a remote...

Medium: nginx

Issue Overview: The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local...