CVE-2021-23017

Description

A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.

How to fix CVE-2021-23017

To remediate CVE-2021-23017, upgrade the affected package to a fixed version below.

• Alpine/nginx—upgrade to 1.16.1-r3 or later
• —upgrade to 1.20.1 or later
• —upgrade to 1.20.1 or later
• —upgrade to 1.18.0-6.1 or later
• —upgrade to 1.10.3-1+deb9u6 or later
• —upgrade to 1.14.2-2+deb10u4 or later

Is CVE-2021-23017 being exploited?

Likely — EPSS is 73.5%, placing CVE-2021-23017 in the top tier of vulnerabilities by exploitation probability. Prioritise patching.

Affected packages (6)

• from 0, < 1.16.1-r3
• >= 0.6.18, < 1.20.1
• >= 0.6.18, < 1.20.1
• from 0, < 1.18.0-6.1
• from 0, < 1.10.3-1+deb9u6
• from 0, < 1.14.2-2+deb10u4

CVSS scores

References (17)

• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2021-23017
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2021-23017
• WEBmailman.nginx.org/pipermail/nginx-announce/2021/000300.html
• WEBpacketstormsecurity.com/files/167720/Nginx-1.20.0-Denial-Of-Service.html