Arch Linux Security Advisory ASA-202106-48 ========================================== Severity: Medium Date : 2021-06-22 CVE-ID : CVE-2021-23017 Package : nginx-mainline Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1987 Summary ======= The package nginx-mainline before version 1.21.0-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.21.0-1. # pacman -Syu "nginx-mainline>=1.21.0-1" The problem has been fixed upstream in version 1.21.0. Workaround ========== The issue can be mitigated by removing the "resolver" directive from the configuration file. Description =========== A security issue in nginx resolver was identified, which might allow an attacker to cause 1-byte memory overwrite by using a specially crafted DNS response, resulting in worker process crash or, potentially, in arbitrary code execution. The issue only affects nginx if the "resolver" directive is used in the configuration file. Further, the attack is only possible if an attacker is able to forge UDP packets from the DNS server. Impact ====== A remote attacker could crash the nginx server, or potentially execute arbitrary code, using a crafted DNS server response. References ========== https://www.x41-dsec.de/lab/advisories/x41-2021-002-nginx-resolver-copy/ https://mailman.nginx.org/pipermail/nginx-announce/2021/000300.html http://nginx.org/download/patch.2021.resolver.txt https://github.com/nginx/nginx/commit/7199ebc203f74fd9e44595474de6bdc41740c5... https://security.archlinux.org/CVE-2021-23017