ALPINE-CVE-2019-20372 PUBLISHED CVSS 5.300000190734863 MEDIUM

NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.

Risk Scores

CVSS v3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected Products

VendorProductVersions
Alpine:v3.11nginx1.10.1-r3, 1.4.6-r0, 1.4.7-r0
Alpine:v3.8nginx1.10.0-r0, 0, 0.8.53-r0
Alpine:v3.15nginx1.10.1-r6, 1.9.14-r1, 1.9.14-r0
Alpine:v3.19nginx1.10.1-r5, 1.10.1-r6, 1.10.1-r7
Alpine:v3.10nginx1.12.2-r1, 1.6.0-r3, 1.14.0-r2
Alpine:v3.16nginx0, 1.10.1-r6, 1.10.1-r7
Alpine:v3.18nginx1.12.2-r0, 0, 0.8.53-r0
Alpine:v3.9nginx1.6.1-r0, 0.8.53-r0, 0.8.54-r1
Alpine:v3.20nginx1.6.0-r1, 1.6.0-r2, 1.6.0-r3
Alpine:v3.17nginx1.6.2-r2, 0, 0.8.53-r0
Alpine:v3.13nginx1.10.1-r0, 0, 0.8.53-r0
Alpine:v3.21nginx1.4.0-r0, 0, 0.8.53-r0
Alpine:v3.23nginx1.0.4-r0, 1.10.3-r4, 1.12.0-r0
Alpine:v3.14nginx1.9.14-r1, 1.12.2-r6, 1.14.0-r2
Alpine:v3.22nginx1.8.1-r1, 0, 0.8.53-r0
Alpine:v3.12nginx1.9.14-r1, 1.9.14-r1, 0.8.54-r0

Timeline

References

Open in Interactive Console →