Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
Nginx: Unauthenticated Remote Code Execution Risk
published 1 year ago
Summary
An update is available for Nginx to fix a security issue that could allow an attacker to execute malicious code on a server without needing a password. This update is important for all Nginx users, especially those who expose their servers to the public internet. Apply the update as soon as possible to ensure the security of your server.
What to do
- Update redhat nginx to version 2:1.20.1-22.el9_6.2.
- Update redhat nginx-all-modules to version 2:1.20.1-22.el9_6.2.
- Update redhat nginx-core to version 2:1.20.1-22.el9_6.2.
- Update redhat nginx-core-debuginfo to version 2:1.20.1-22.el9_6.2.
- Update redhat nginx-debuginfo to version 2:1.20.1-22.el9_6.2.
- Update redhat nginx-debugsource to version 2:1.20.1-22.el9_6.2.
- Update redhat nginx-filesystem to version 2:1.20.1-22.el9_6.2.
- Update redhat nginx-mod-devel to version 2:1.20.1-22.el9_6.2.
- Update redhat nginx-mod-http-image-filter to version 2:1.20.1-22.el9_6.2.
- Update redhat nginx-mod-http-image-filter-debuginfo to version 2:1.20.1-22.el9_6.2.
- Update redhat nginx-mod-http-perl to version 2:1.20.1-22.el9_6.2.
- Update redhat nginx-mod-http-perl-debuginfo to version 2:1.20.1-22.el9_6.2.
- Update redhat nginx-mod-http-xslt-filter to version 2:1.20.1-22.el9_6.2.
- Update redhat nginx-mod-http-xslt-filter-debuginfo to version 2:1.20.1-22.el9_6.2.
- Update redhat nginx-mod-mail to version 2:1.20.1-22.el9_6.2.
- Update redhat nginx-mod-mail-debuginfo to version 2:1.20.1-22.el9_6.2.
- Update redhat nginx-mod-stream to version 2:1.20.1-22.el9_6.2.
- Update redhat nginx-mod-stream-debuginfo to version 2:1.20.1-22.el9_6.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:enterprise_linux:9::appstream | redhat | nginx |
< 2:1.20.1-22.el9_6.2 Fix: upgrade to 2:1.20.1-22.el9_6.2
|
| Red Hat:enterprise_linux:9::appstream | redhat | nginx-all-modules |
< 2:1.20.1-22.el9_6.2 Fix: upgrade to 2:1.20.1-22.el9_6.2
|
| Red Hat:enterprise_linux:9::appstream | redhat | nginx-core |
< 2:1.20.1-22.el9_6.2 Fix: upgrade to 2:1.20.1-22.el9_6.2
|
| Red Hat:enterprise_linux:9::appstream | redhat | nginx-core-debuginfo |
< 2:1.20.1-22.el9_6.2 Fix: upgrade to 2:1.20.1-22.el9_6.2
|
| Red Hat:enterprise_linux:9::appstream | redhat | nginx-debuginfo |
< 2:1.20.1-22.el9_6.2 Fix: upgrade to 2:1.20.1-22.el9_6.2
|
| Red Hat:enterprise_linux:9::appstream | redhat | nginx-debugsource |
< 2:1.20.1-22.el9_6.2 Fix: upgrade to 2:1.20.1-22.el9_6.2
|
| Red Hat:enterprise_linux:9::appstream | redhat | nginx-filesystem |
< 2:1.20.1-22.el9_6.2 Fix: upgrade to 2:1.20.1-22.el9_6.2
|
| Red Hat:enterprise_linux:9::appstream | redhat | nginx-mod-devel |
< 2:1.20.1-22.el9_6.2 Fix: upgrade to 2:1.20.1-22.el9_6.2
|
| Red Hat:enterprise_linux:9::appstream | redhat | nginx-mod-http-image-filter |
< 2:1.20.1-22.el9_6.2 Fix: upgrade to 2:1.20.1-22.el9_6.2
|
| Red Hat:enterprise_linux:9::appstream | redhat | nginx-mod-http-image-filter-debuginfo |
< 2:1.20.1-22.el9_6.2 Fix: upgrade to 2:1.20.1-22.el9_6.2
|
| Red Hat:enterprise_linux:9::appstream | redhat | nginx-mod-http-perl |
< 2:1.20.1-22.el9_6.2 Fix: upgrade to 2:1.20.1-22.el9_6.2
|
| Red Hat:enterprise_linux:9::appstream | redhat | nginx-mod-http-perl-debuginfo |
< 2:1.20.1-22.el9_6.2 Fix: upgrade to 2:1.20.1-22.el9_6.2
|
| Red Hat:enterprise_linux:9::appstream | redhat | nginx-mod-http-xslt-filter |
< 2:1.20.1-22.el9_6.2 Fix: upgrade to 2:1.20.1-22.el9_6.2
|
| Red Hat:enterprise_linux:9::appstream | redhat | nginx-mod-http-xslt-filter-debuginfo |
< 2:1.20.1-22.el9_6.2 Fix: upgrade to 2:1.20.1-22.el9_6.2
|
| Red Hat:enterprise_linux:9::appstream | redhat | nginx-mod-mail |
< 2:1.20.1-22.el9_6.2 Fix: upgrade to 2:1.20.1-22.el9_6.2
|
| Red Hat:enterprise_linux:9::appstream | redhat | nginx-mod-mail-debuginfo |
< 2:1.20.1-22.el9_6.2 Fix: upgrade to 2:1.20.1-22.el9_6.2
|
| Red Hat:enterprise_linux:9::appstream | redhat | nginx-mod-stream |
< 2:1.20.1-22.el9_6.2 Fix: upgrade to 2:1.20.1-22.el9_6.2
|
| Red Hat:enterprise_linux:9::appstream | redhat | nginx-mod-stream-debuginfo |
< 2:1.20.1-22.el9_6.2 Fix: upgrade to 2:1.20.1-22.el9_6.2
|
| Red Hat:enterprise_linux:9::crb | redhat | nginx |
< 2:1.20.1-22.el9_6.2 Fix: upgrade to 2:1.20.1-22.el9_6.2
|
| Red Hat:enterprise_linux:9::crb | redhat | nginx-all-modules |
< 2:1.20.1-22.el9_6.2 Fix: upgrade to 2:1.20.1-22.el9_6.2
|
| Red Hat:enterprise_linux:9::crb | redhat | nginx-core |
< 2:1.20.1-22.el9_6.2 Fix: upgrade to 2:1.20.1-22.el9_6.2
|
| Red Hat:enterprise_linux:9::crb | redhat | nginx-core-debuginfo |
< 2:1.20.1-22.el9_6.2 Fix: upgrade to 2:1.20.1-22.el9_6.2
|
| Red Hat:enterprise_linux:9::crb | redhat | nginx-debuginfo |
< 2:1.20.1-22.el9_6.2 Fix: upgrade to 2:1.20.1-22.el9_6.2
|
| Red Hat:enterprise_linux:9::crb | redhat | nginx-debugsource |
< 2:1.20.1-22.el9_6.2 Fix: upgrade to 2:1.20.1-22.el9_6.2
|
| Red Hat:enterprise_linux:9::crb | redhat | nginx-filesystem |
< 2:1.20.1-22.el9_6.2 Fix: upgrade to 2:1.20.1-22.el9_6.2
|
| Red Hat:enterprise_linux:9::crb | redhat | nginx-mod-devel |
< 2:1.20.1-22.el9_6.2 Fix: upgrade to 2:1.20.1-22.el9_6.2
|
| Red Hat:enterprise_linux:9::crb | redhat | nginx-mod-http-image-filter |
< 2:1.20.1-22.el9_6.2 Fix: upgrade to 2:1.20.1-22.el9_6.2
|
| Red Hat:enterprise_linux:9::crb | redhat | nginx-mod-http-image-filter-debuginfo |
< 2:1.20.1-22.el9_6.2 Fix: upgrade to 2:1.20.1-22.el9_6.2
|
| Red Hat:enterprise_linux:9::crb | redhat | nginx-mod-http-perl |
< 2:1.20.1-22.el9_6.2 Fix: upgrade to 2:1.20.1-22.el9_6.2
|
| Red Hat:enterprise_linux:9::crb | redhat | nginx-mod-http-perl-debuginfo |
< 2:1.20.1-22.el9_6.2 Fix: upgrade to 2:1.20.1-22.el9_6.2
|
| Red Hat:enterprise_linux:9::crb | redhat | nginx-mod-http-xslt-filter |
< 2:1.20.1-22.el9_6.2 Fix: upgrade to 2:1.20.1-22.el9_6.2
|
| Red Hat:enterprise_linux:9::crb | redhat | nginx-mod-http-xslt-filter-debuginfo |
< 2:1.20.1-22.el9_6.2 Fix: upgrade to 2:1.20.1-22.el9_6.2
|
| Red Hat:enterprise_linux:9::crb | redhat | nginx-mod-mail |
< 2:1.20.1-22.el9_6.2 Fix: upgrade to 2:1.20.1-22.el9_6.2
|
| Red Hat:enterprise_linux:9::crb | redhat | nginx-mod-mail-debuginfo |
< 2:1.20.1-22.el9_6.2 Fix: upgrade to 2:1.20.1-22.el9_6.2
|
| Red Hat:enterprise_linux:9::crb | redhat | nginx-mod-stream |
< 2:1.20.1-22.el9_6.2 Fix: upgrade to 2:1.20.1-22.el9_6.2
|
| Red Hat:enterprise_linux:9::crb | redhat | nginx-mod-stream-debuginfo |
< 2:1.20.1-22.el9_6.2 Fix: upgrade to 2:1.20.1-22.el9_6.2
|
Original advisory text
Red Hat Security Advisory: nginx security update
References
- https://access.redhat.com/errata/RHSA-2025:7402 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#moderate Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2141495 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2141496 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7402.j... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2022-41741 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-41741 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-41741 Vendor Advisory
- https://nginx.org/en/security_advisories.html Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2022-41742 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-41742 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-41742 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2024-7347 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2304966 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2024-7347 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-7347 Vendor Advisory
- https://my.f5.com/manage/s/article/K000140529 Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Timeline
Published14 May 2025
Updated10 Jun 2026
First seen10 Jun 2026
Sources
RHSA-2025:7402 · OSV
Track software like this
Free during beta