Vulnerability · Published Oct 19, 2022 · Assigned by f5
CVE-2022-41741NGINX ngx_http_mp4_module vulnerability CVE-2022-41741
High 7.0
In plain English
A high-severity out-of-bounds write in NGINX from F5. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its termination or potential other impact using a specially crafted audio or video file. The issue affects only NGINX products that are built with the ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_mp4_module.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:9 | nginx | 2:1.20.1-22.el9_6.2.alma.1 | ALSA-2025:7402 |
| AlmaLinux:9 | nginx-all-modules | 2:1.20.1-22.el9_6.2.alma.1 | ALSA-2025:7402 |
| AlmaLinux:9 | nginx-core | 2:1.20.1-22.el9_6.2.alma.1 | ALSA-2025:7402 |
| AlmaLinux:9 | nginx-filesystem | 2:1.20.1-22.el9_6.2.alma.1 | ALSA-2025:7402 |
| AlmaLinux:9 | nginx-mod-devel | 2:1.20.1-22.el9_6.2.alma.1 | ALSA-2025:7402 |
| AlmaLinux:9 | nginx-mod-http-image-filter | 2:1.20.1-22.el9_6.2.alma.1 | ALSA-2025:7402 |
| AlmaLinux:9 | nginx-mod-http-perl | 2:1.20.1-22.el9_6.2.alma.1 | ALSA-2025:7402 |
| AlmaLinux:9 | nginx-mod-http-xslt-filter | 2:1.20.1-22.el9_6.2.alma.1 | ALSA-2025:7402 |
| AlmaLinux:9 | nginx-mod-mail | 2:1.20.1-22.el9_6.2.alma.1 | ALSA-2025:7402 |
| AlmaLinux:9 | nginx-mod-stream | 2:1.20.1-22.el9_6.2.alma.1 | ALSA-2025:7402 |
| Alpine:v3.20 | nginx | 1.22.1-r0 | ALPINE-CVE-2022-41741 |
| Alpine:v3.21 | nginx | 1.22.1-r0 | ALPINE-CVE-2022-41741 |
| Alpine:v3.22 | nginx | 1.22.1-r0 | ALPINE-CVE-2022-41741 |
| Alpine:v3.23 | nginx | 1.22.1-r0 | ALPINE-CVE-2022-41741 |
| Alpine:v3.24 | nginx | 1.22.1-r0 | ALPINE-CVE-2022-41741 |
| Debian:12 | nginx | 1.22.1-1 | DEBIAN-CVE-2022-41741 |
| Debian:13 | nginx | 1.22.1-1 | DEBIAN-CVE-2022-41741 |
| Debian:14 | nginx | 1.22.1-1 | DEBIAN-CVE-2022-41741 |
| Rocky Linux:9 | nginx | 2:1.20.1-22.el9_6.2 | RLSA-2025:7402 |
| Ubuntu:22.04:LTS | nginx | 1.18.0-6ubuntu14.3 | USN-5722-1 |
| Ubuntu:22.04:LTS | nginx | 1.18.0-6ubuntu14.3 | UBUNTU-CVE-2022-41741 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| F5 | NGINX | Mainline – before 1.23.2Stable – before 1.22.1 |
| F5 | NGINX Plus | R27 – before R27-p1R1 – before R26-p1 |
| F5 | NGINX Open Source Subscription | R2 – before R2 P1R1 – before R1 P1 |
Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://support.f5.com/csp/article/K81926432
- FEDORA-2022-b0f5bc2175 vendor-advisory
- FEDORA-2022-97de53f202 vendor-advisory
- FEDORA-2022-12721789aa vendor-advisory
- DSA-5281 vendor-advisory
- [debian-lts-announce] 20221122 [SECURITY] [DLA 3203-1] nginx security update mailing-list
- https://security.netapp.com/advisory/ntap-20230120-0005/