Updated nginx package fixes a security vulnerability
Publication date: 29 Jun 2021Type: security
Affected Mageia releases : 7 , 8
CVE: CVE-2021-23017
Description
A flaw was found in nginx. An off-by-one error while processing DNS responses allows a network attacker to write a dot character out of bounds in a heap allocated buffer which can allow overwriting the least significant byte of next heap chunk metadata likely leading to a remote code execution in certain circumstances. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability (CVE-2021-23017).
References
SRPMS
7/core
- nginx-1.16.1-1.3.mga7
8/core
- nginx-1.18.0-5.1.mga8