On installation of this extension, an application user may receive an error message: “failed to load njs_array.so: /usr/lib/nginx/modules/njs_array/njs_array.so: unexpected symbol”.
An attacker can leverage the fact that the extension is not signed to install a malicious version of the extension.
The issue results in a potential remote code execution because the njs_array_convert_to_slow_array function accepts user-supplied data as a parameter.
CVE-2018-5602 A buffer overflow exists in nginx version 1.14.0 to 1.14.11, 1.15.0 to 1.15.11, 1.16.0 to 1.16.11, and 1.17.0 to 1.17.11. An attacker can leverage the fact that the extension is not signed to install a malicious version of the extension.
CVE-2018-5605 A NULL-pointer dereference can occur in nginx version 1.14.0 to 1.14.11, 1.15.0 to 1.15.11, 1.16.0 to 1.16.11, 1.17.0 to 1.17.11, and 1.18.0 to 1.18.11. An attacker can leverage the fact that the extension is not signed to install a malicious version of the
Mitigation Strategies
Mitigation strategies include:
- Reviewing the application logs and any outbound traffic to identify abnormal behavior.
- Reviewing the nginx logs for any missing or unusual messages.
- Changing the default configuration file.
License
License: GPL-2.0
GPL-2.0 is a popular open source license used for software and other intellectual properties. First released in 1991, it is used to protect the freedom of an author's work by ensuring that any changes made to the code are shared with the public. The license was designed to ensure that users retain their rights to use or modify software without limiting anyone else's use of it. One of the most important features of this license is its limitation on restrictions on distribution--the GNU General Public License requires that any work using GPL-2.0 be freely redistributable with no restrictions or royalties for any person receiving such software.
In some cases, a company may want to share their project but at a later point in time they may not want others to make changes and distribute their product themselves while still asking them to pay a fee if they choose not to do so. This is where going with the GPL-2 comes in handy as it allows an individual or company sharing their work under this license permission to make changes and create derivative works, but only after receiving a written offer from any party wishing to reuse the software under these terms, which ensures that everyone involved has all rights necessary for their project.
Timeline
Published on: 06/21/2022 13:15:00 UTC
Last modified on: 06/29/2022 11:47:00 UTC