Bug 2141496 (CVE-2022-41742)

Summary: CVE-2022-41742 nginx: Memory disclosure in the ngx_http_mp4_module
Product: [Other] Security Response Reporter: Sandipan Roy <saroy>
Component: vulnerabilityAssignee: Nobody <nobody>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abrianik, adudiak, bcoca, bdettelb, brking, caswilli, crizzo, derrick.roach.ctr, dffrench, doconnor, epacific, gzaronik, haoli, hhorak, hkataria, jajackso, jcammara, jhardy, jmitchel, jneedle, jobarker, jorton, jtanner, jwong, jwon, kaycoth, kegrant, koliveir, kshier, luhliari, mabashia, mepley, ngough, omaciel, pbraun, rgodfrey, shvarugh, simaishi, smcdonal, stcannon, teagle, tfister, thavo, yguenane, zsadeh
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was found in NGINX’s module, ngx_http_mp4_module. This flaw allows a local attacker to cause a worker process crash or might result in worker process memory disclosure by using a specially crafted audio or video file. The issue affects only NGINX products built with ngx_http_mp4_module when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger the processing of a specially crafted audio or video file with ngx_http_mp4_module.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2148866, 2141497, 2141498, 2141499, 2141500, 2141501, 2141502, 2141503, 2141504, 2141505, 2141513, 2141515    
Bug Blocks: 2136367    

Description Sandipan Roy 2022-11-10 04:53:41 UTC 
NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted audio or video file. The issue affects only NGINX products that are built with the module ngx_http_mp4_module, when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger processing of a specially crafted audio or video file with the module ngx_http_mp4_module.

https://nginx.org/en/security_advisories.html
Comment 1 Sandipan Roy 2022-11-10 04:58:33 UTC 
Created nginx tracking bugs for this issue:

Affects: epel-all [bug 2141498]
Affects: fedora-all [bug 2141500]


Created nginx:1.20/nginx tracking bugs for this issue:

Affects: fedora-all [bug 2141501]


Created nginx:mainline/nginx tracking bugs for this issue:

Affects: epel-all [bug 2141499]
Affects: fedora-all [bug 2141502]
Comment 16 errata-xmlrpc 2025-05-13 11:52:46 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:7402 https://access.redhat.com/errata/RHSA-2025:7402
Comment 17 errata-xmlrpc 2025-05-14 02:00:05 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2025:7546 https://access.redhat.com/errata/RHSA-2025:7546
Comment 18 errata-xmlrpc 2025-05-14 16:17:00 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2025:7619 https://access.redhat.com/errata/RHSA-2025:7619