The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5281 advisory.

  - NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1     and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module     ngx_http_mp4_module that might allow a local attacker to corrupt NGINX worker memory, resulting in its     termination or potential other impact using a specially crafted audio or video file. The issue affects     only NGINX products that are built with the ngx_http_mp4_module, when the mp4 directive is used in the     configuration file. Further, the attack is possible only if an attacker can trigger processing of a     specially crafted audio or video file with the module ngx_http_mp4_module. (CVE-2022-41741)

  - NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1     and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module     ngx_http_mp4_module that might allow a local attacker to cause a worker process crash, or might result in     worker process memory disclosure by using a specially crafted audio or video file. The issue affects only     NGINX products that are built with the module ngx_http_mp4_module, when the mp4 directive is used in the     configuration file. Further, the attack is possible only if an attacker can trigger processing of a     specially crafted audio or video file with the module ngx_http_mp4_module. (CVE-2022-41742)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian DSA-5281-1 : nginx - security update

high Nessus Plugin ID 167747

Version 1.4

Version 1.3

Version 1.2

Version 1.4 Nov 2, 2023, 2:21 PM IAVM reference Plugin Feed: 202311021421
Version 1.3 Nov 24, 2022, 4:13 PM CVSS metrics ("CVSSv2 score" changed from "1.9" to "6.8") CVSS metrics ("CVSSv2 vector" changed from "CVSS2#AV:L/AC:M/Au:N/C:P/I:N/A:N" to "CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C") CVSSv2 score source (changed from "CVE-2022-41742" to "CVE-2022-41741") CVSSv2 severity (based on CVE-2022-41741, severity increased from "Low" to "Medium") Plugin Feed: 202211241613
Version 1.2 Nov 17, 2022, 1:52 AM New Plugin Feed: 202211170152