Bug 1644508 (CVE-2018-16845)
| Summary: | CVE-2018-16845 nginx: Denial of service and memory disclosure via mp4 module | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Sam Fowler <sfowler> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | abhgupta, affix, athmanem, bperkins, cmoore, dajohnso, dbaker, dmetzger, gblomqui, gmainwar, gmccullo, gtanzill, hhorak, jeremy, jfrey, jhardy, jkaluza, jlaska, jokerman, jorton, jprause, kaycoth, kdixon, kwalsh, luhliari, obarenbo, pavel.lisy, peter.borsa, rcosta, roliveri, security-response-team, simaishi, sthangav, tadej.j, trankin, wtogami |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | nginx 1.15.6, nginx 1.14.1 | Doc Type: | If docs needed, set a value |
| Doc Text: |
An instance of missing input sanitization was found in the mp4 module for nginx. A local attacker could create a specially crafted video file that, when streamed by the server, would cause a denial of service (server crash or hang) and, possibly, information disclosure.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-06-10 10:41:20 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1647255, 1647256, 1647257, 1648219, 1648220, 1648221, 1648223, 1648362, 1648363, 1648364, 1648365, 1888168 | ||
| Bug Blocks: | 1644513 | ||
|
Description
Sam Fowler
2018-10-31 04:02:02 UTC
Acknowledgments: Name: the Nginx project Ansible Tower is not using ngx_http_mp4_module at all, therefore is not affected. Already did some research and discuss with Satoe I. from CloudForms. CFME is not using in any way nginx more than the inclusion from Ansible Tower (not changed or altered configuration or used outside from Tower), and Ansible Tower is not affected, so CloudForms is also not affected; updating the task accordingly. External Reference: http://mailman.nginx.org/pipermail/nginx-announce/2018/000221.html Upstream Patch: http://nginx.org/download/patch.2018.mp4.txt Created nginx tracking bugs for this issue: Affects: epel-all [bug 1647256] Affects: fedora-all [bug 1647255] Mercurial commit that patches this flaw: http://hg.nginx.org/nginx/rev/fdc19a3289c1 ngx_http_mp4_read_atom() function in ngx_http_mp4_module.c file does not check if atom_size in a 64-bit atom in mp4 files is greater than the minimum value atom_header_size, which is 16 for 64-bit atoms. When atom_header_size is subtracted from atom_size, the result may underflow and cause various issues like infinite loops, when the size is 0, crashes or memory disclosure. This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 6 Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Via RHSA-2018:3652 https://access.redhat.com/errata/RHSA-2018:3652 This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Red Hat Software Collections for Red Hat Enterprise Linux 6 Via RHSA-2018:3653 https://access.redhat.com/errata/RHSA-2018:3653 This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Via RHSA-2018:3680 https://access.redhat.com/errata/RHSA-2018:3680 This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Via RHSA-2018:3681 https://access.redhat.com/errata/RHSA-2018:3681 |