Your submission was sent successfully! Close

CVE-2020-36309

Published: 6 April 2021

ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header.

Notes

AuthorNote
mdeslaur
The lua module is included in the debian directory as it is not
part of the upstream nginx release.
It is included in the nginx-extras binary package in universe.
sbeattie
fix introduced upstream issue 1676, and addressed by
beb5c6ba03b654c
lua-nginx-module was pulled from the nginx package in ubuntu
in Ubuntu 21.04 (hirsute) version 1.18.0-6ubuntu8
Priority

Low

CVSS 3 base score: 5.3

Status

Package Release Status
nginx
Launchpad, Ubuntu, Debian
bionic
Released (1.14.0-0ubuntu1.10)
focal
Released (1.18.0-0ubuntu1.3)
groovy Ignored
(reached end-of-life)
hirsute Not vulnerable
(1.18.0-6ubuntu8)
impish Not vulnerable
(1.18.0-6ubuntu8)
jammy Not vulnerable
(1.18.0-6ubuntu8)
kinetic Not vulnerable
(1.18.0-6ubuntu8)
precise Does not exist

trusty Needed

upstream Needs triage

xenial
Released (1.10.3-0ubuntu0.16.04.5+esm3)
Patches:
upstream: https://github.com/openresty/lua-nginx-module/pull/1654/commits/041d7d1c8539f92062c2a79cf18f550542bccc2e
upstream: https://github.com/openresty/lua-nginx-module/commit/beb5c6ba03b654c3e435e9a7c6a05d44d1550861
Binaries built from this source package are in Universe and so are supported by the community.