Your submission was sent successfully! Close

CVE-2020-36309

Published: 6 April 2021

ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header.

Priority

Low

CVSS 3 base score: 5.3

Status

Package Release Status
nginx
Launchpad, Ubuntu, Debian
bionic
Released (1.14.0-0ubuntu1.10)
focal
Released (1.18.0-0ubuntu1.3)
groovy Ignored
(reached end-of-life)
hirsute Not vulnerable
(1.18.0-6ubuntu8)
impish Not vulnerable
(1.18.0-6ubuntu8)
jammy Not vulnerable
(1.18.0-6ubuntu8)
precise Does not exist

trusty Needed

upstream Needs triage

xenial Needed

Notes

AuthorNote
mdeslaur
The lua module is included in the debian directory as it is not
part of the upstream nginx release.
It is included in the nginx-extras binary package in universe.
sbeattie
fix introduced upstream issue 1676, and addressed by
beb5c6ba03b654c
lua-nginx-module was pulled from the nginx package in ubuntu
in Ubuntu 21.04 (hirsute) version 1.18.0-6ubuntu8

References

Bugs