Bug 2141495 (CVE-2022-41741)

Summary: CVE-2022-41741 nginx: Memory corruption in the ngx_http_mp4_module
Product: [Other] Security Response Reporter: Sandipan Roy <saroy>
Component: vulnerabilityAssignee: Nobody <nobody>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abrianik, adudiak, bcoca, bdettelb, caswilli, davidn, derrick.roach.ctr, dffrench, epacific, gzaronik, hhorak, jcammara, jhardy, jneedle, jobarker, jorton, jwong, jwon, kaycoth, kshier, luhliari, mabashia, ngough, osapryki, rgodfrey, simaishi, smcdonal, stcannon, teagle, tfister, yguenane, zsadeh
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was found in NGINX's module, ngx_http_mp4_module. This flaw allows a local attacker to corrupt NGINX worker memory, resulting in its termination using a specially crafted audio or video file. The issue affects only NGINX products built with ngx_http_mp4_module when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger the processing of a specially crafted audio or video file with ngx_http_mp4_module.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2148865, 2141506, 2141507, 2141508, 2141509, 2141510, 2141511, 2141512, 2141514, 2141516, 2141517, 2141518    
Bug Blocks: 2136367    

Description Sandipan Roy 2022-11-10 04:51:40 UTC 
NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its termination or potential other impact using a specially crafted audio or video file. The issue affects only NGINX products that are built with the ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_mp4_module.

https://nginx.org/en/security_advisories.html
Comment 1 Sandipan Roy 2022-11-10 05:01:22 UTC 
Created nginx tracking bugs for this issue:

Affects: epel-all [bug 2141507]
Affects: fedora-all [bug 2141509]


Created nginx:1.20/nginx tracking bugs for this issue:

Affects: fedora-all [bug 2141510]


Created nginx:mainline/nginx tracking bugs for this issue:

Affects: epel-all [bug 2141508]
Affects: fedora-all [bug 2141511]