Vulnerability · Published Oct 19, 2022 · Assigned by f5

CVE-2022-41743NGINX ngx_http_hls_module vulnerability CVE-2022-41743

High 7.0

In plain English

A high-severity out-of-bounds write in NGINX Plus from F5. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)7.0High

Exploit odds (30 days)0.2%top 86.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_hls_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its crash or potential other impact using a specially crafted audio or video file. The issue affects only NGINX Plus when the hls directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_hls_module.

Affected products (as reported)

Vendor	Product	Versions
F5	NGINX Plus	R27 – before R27-p1R1 – before R26-p1

Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://support.f5.com/csp/article/K01112063