Vulnerability Description
Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| F5 | Nginx | >= 0.5.6, <= 1.12.1 |
| Puppet | Puppet Enterprise | < 2016.4.7 |
| Apple | Xcode | < 13.0 |
Related Weaknesses (CWE)
References
- http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.htmlVendor Advisory
- http://seclists.org/fulldisclosure/2021/Sep/36Mailing ListThird Party Advisory
- http://www.securityfocus.com/bid/99534Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1039238Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2017:2538Third Party Advisory
- https://puppet.com/security/cve/cve-2017-7529Third Party Advisory
- https://support.apple.com/kb/HT212818Third Party Advisory
- http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.htmlVendor Advisory
- http://seclists.org/fulldisclosure/2021/Sep/36Mailing ListThird Party Advisory
- http://www.securityfocus.com/bid/99534Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1039238Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2017:2538Third Party Advisory
- https://puppet.com/security/cve/cve-2017-7529Third Party Advisory
- https://support.apple.com/kb/HT212818Third Party Advisory
FAQ
What is CVE-2017-7529?
CVE-2017-7529 is a vulnerability with a CVSS score of 7.5 (HIGH). Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered b...
How severe is CVE-2017-7529?
CVE-2017-7529 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-7529?
Check the references section above for vendor advisories and patch information. Affected products include: F5 Nginx, Puppet Puppet Enterprise, Apple Xcode.