CVE-2021-23017

Published: Jun 1, 2021Modified: Jun 17, 2026

7.7

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Exploitability: 2.2 / Impact: 5.5

Source: NVD

Description

A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.

Affected (25)

Products: F5: Nginx · Openresty: Openresty · Fedoraproject: Fedora · +2 more

Show all products

F5: Nginx · Openresty: Openresty · Fedoraproject: Fedora · Netapp: Ontap Select Deploy Administration Utility · Oracle: Blockchain Platform, Communications Control Plane Monitor, Communications Fraud Monitor, Communications Operations Monitor, Communications Session Border Controller, Enterprise Communications Broker, Enterprise Session Border Controller, Enterprise Telephony Fraud Monitor, Goldengate

1 product

1 product

1 product

1 product

Ontap Select Deploy Administration Utility

9 products

Blockchain Platform

Communications Control Plane Monitor

Communications Fraud Monitor

Communications Operations Monitor

Communications Session Border Controller

Enterprise Communications Broker

Enterprise Session Border Controller

Enterprise Telephony Fraud Monitor

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
F5 Nginx	From 0.6.18 to 1.20.1

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Openresty Openresty	Before 1.19.3.2

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 33
Fedoraproject Fedora	Version 34

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Netapp Ontap Select Deploy Administration Utility	All versions

Configuration E

20 vulnerable

Vulnerable Software	Affected Versions
Oracle Blockchain Platform	Before 21.1.2
Oracle Communications Control Plane Monitor	Version 3.4
Oracle Communications Control Plane Monitor	Version 4.2
Oracle Communications Control Plane Monitor	Version 4.3
Oracle Communications Control Plane Monitor	Version 4.4
Oracle Communications Fraud Monitor	From 3.4 to 4.4
Oracle Communications Operations Monitor	Version 3.4
Oracle Communications Operations Monitor	Version 4.2
Oracle Communications Operations Monitor	Version 4.3
Oracle Communications Operations Monitor	Version 4.4
Oracle Communications Session Border Controller	Version 8.4
Oracle Communications Session Border Controller	Version 9.0
Oracle Enterprise Communications Broker	Version 3.3.0
Oracle Enterprise Session Border Controller	Version 8.4
Oracle Enterprise Session Border Controller	Version 9.0
Oracle Enterprise Telephony Fraud Monitor	Version 3.4
Oracle Enterprise Telephony Fraud Monitor	Version 4.2
Oracle Enterprise Telephony Fraud Monitor	Version 4.3
Oracle Enterprise Telephony Fraud Monitor	Version 4.4
Oracle Goldengate	Before 21.4.0.0.0

Related CWEs

Off-by-one Error

A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

References (28)

http://mailman.nginx.org/pipermail/nginx-announce/2021/000300.html

Source: f5sirt@f5.com

Mailing ListPatchVendor Advisory

http://packetstormsecurity.com/files/167720/Nginx-1.20.0-Denial-Of-Service.html

Source: f5sirt@f5.com

Third Party AdvisoryVDB Entry

https://lists.apache.org/thread.html/r37e6b2165f7c910d8e15fd54f4697857619ad2625f56583802004009%40%3Cnotifications.apisix.apache.org%3E

Source: f5sirt@f5.com

https://lists.apache.org/thread.html/r4d4966221ca399ce948ef34884652265729d7d9ef8179c78d7f17e7f%40%3Cnotifications.apisix.apache.org%3E

Source: f5sirt@f5.com

https://lists.apache.org/thread.html/r6fc5c57b38e93e36213e9a18c8a4e5dbd5ced1c7e57f08a1735975ba%40%3Cnotifications.apisix.apache.org%3E

Source: f5sirt@f5.com

https://lists.apache.org/thread.html/rf232eecd47fdc44520192810560303073cefd684b321f85e311bad31%40%3Cnotifications.apisix.apache.org%3E

Source: f5sirt@f5.com

https://lists.apache.org/thread.html/rf318aeeb4d7a3a312734780b47de83cefb7e6995da0b2cae5c28675c%40%3Cnotifications.apisix.apache.org%3E

Source: f5sirt@f5.com

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7SFVYHC7OXTEO4SMBWXDVK6E5IMEYMEE/

Source: f5sirt@f5.com

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GNKOP2JR5L7KCIZTJRZDCUPJTUONMC5I/

Source: f5sirt@f5.com

https://security.netapp.com/advisory/ntap-20210708-0006/

Source: f5sirt@f5.com

Third Party Advisory

https://support.f5.com/csp/article/K12331123%2C

Source: f5sirt@f5.com

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: f5sirt@f5.com

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: f5sirt@f5.com

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: f5sirt@f5.com

PatchThird Party Advisory

http://mailman.nginx.org/pipermail/nginx-announce/2021/000300.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatchVendor Advisory

http://packetstormsecurity.com/files/167720/Nginx-1.20.0-Denial-Of-Service.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://lists.apache.org/thread.html/r37e6b2165f7c910d8e15fd54f4697857619ad2625f56583802004009%40%3Cnotifications.apisix.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/r4d4966221ca399ce948ef34884652265729d7d9ef8179c78d7f17e7f%40%3Cnotifications.apisix.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/r6fc5c57b38e93e36213e9a18c8a4e5dbd5ced1c7e57f08a1735975ba%40%3Cnotifications.apisix.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/rf232eecd47fdc44520192810560303073cefd684b321f85e311bad31%40%3Cnotifications.apisix.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/rf318aeeb4d7a3a312734780b47de83cefb7e6995da0b2cae5c28675c%40%3Cnotifications.apisix.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7SFVYHC7OXTEO4SMBWXDVK6E5IMEYMEE/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GNKOP2JR5L7KCIZTJRZDCUPJTUONMC5I/

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.netapp.com/advisory/ntap-20210708-0006/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://support.f5.com/csp/article/K12331123%2C

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.