Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Nginx range filter may expose data to attackers

CVE-2017-7529 · published 9 years ago
Summary

Versions of Nginx from 0.5.6 through 1.13.2, including the builds used by F5, Puppet Enterprise and Xcode, can leak potentially sensitive information when they receive a specially crafted request. The leak occurs because the range filter component miscalculates a number and reveals data it shouldn’t. Upgrade to a newer Nginx release or apply the vendor’s recommended patch to stop the leakage.

What to do
  • Update apple xcode to version 13.0 or later.
Affected software
VendorProductAffected versions
f5 nginx >= 0.5.6, <= 1.12.1
>= 1.13.0, <= 1.13.2
cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*
puppet puppet_enterprise < 2016.4.7
>= 2017.1.0, <= 2017.1.1
>= 2017.2.1, <= 2017.2.3
cpe:2.3:a:puppet:puppet_enterprise:*:*:*:*:*:*:*:*
apple xcode < 13.0
cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:*
Original advisory text
Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggere...
Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
63% chance of attack within 30 days
Type
CWE-190Integer Overflow
Timeline
Published13 Jul 2017
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2017-7529 · NVD
Track software like this
Free during beta