Bug 2141495 (CVE-2022-41741)

Summary:	CVE-2022-41741 nginx: Memory corruption in the ngx_http_mp4_module
Product:	[Other] Security Response	Reporter:	Sandipan Roy <saroy>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abrianik, adudiak, bcoca, bdettelb, brking, caswilli, crizzo, derrick.roach.ctr, dffrench, doconnor, epacific, gzaronik, haoli, hhorak, hkataria, jajackso, jcammara, jhardy, jmitchel, jneedle, jobarker, jorton, jtanner, jwong, jwon, kaycoth, kegrant, koliveir, kshier, luhliari, mabashia, mhhall3, michael.h.hall-1, ngough, omaciel, pbraun, rgodfrey, shvarugh, simaishi, smcdonal, stcannon, teagle, tfister, thavo, yguenane, zsadeh
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was found in NGINX's module, ngx_http_mp4_module. This flaw allows a local attacker to corrupt NGINX worker memory, resulting in its termination using a specially crafted audio or video file. The issue affects only NGINX products built with ngx_http_mp4_module when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger the processing of a specially crafted audio or video file with ngx_http_mp4_module.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2148865, 2141506, 2141507, 2141508, 2141509, 2141510, 2141511, 2141512, 2141514, 2141516, 2141517, 2141518
Bug Blocks:	2136367

Description Sandipan Roy 2022-11-10 04:51:40 UTC

NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its termination or potential other impact using a specially crafted audio or video file. The issue affects only NGINX products that are built with the ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_mp4_module.

https://nginx.org/en/security_advisories.html

Comment 1 Sandipan Roy 2022-11-10 05:01:22 UTC

Created nginx tracking bugs for this issue:

Affects: epel-all [bug 2141507]
Affects: fedora-all [bug 2141509]


Created nginx:1.20/nginx tracking bugs for this issue:

Affects: fedora-all [bug 2141510]


Created nginx:mainline/nginx tracking bugs for this issue:

Affects: epel-all [bug 2141508]
Affects: fedora-all [bug 2141511]

Comment 15 errata-xmlrpc 2025-05-13 11:52:45 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:7402 https://access.redhat.com/errata/RHSA-2025:7402

Comment 16 errata-xmlrpc 2025-05-14 02:00:02 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2025:7546 https://access.redhat.com/errata/RHSA-2025:7546

Comment 17 errata-xmlrpc 2025-05-14 16:16:59 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2025:7619 https://access.redhat.com/errata/RHSA-2025:7619