The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5859 advisory.

    - Adress CVE-2019-9511
    - Adress CVE-2018-16845
    - Adress CVE-2017-7529
    - Adress CVE-2019-9511
    - Adress CVE-2018-16845

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to it's self reported version, the installed version of Nginx Plus is prior to R13 (built on Open Source version 1.13.4). It is, therefore, affected by an integer overflow vulnerability in the range filter module. An unauthenticated, remote attacker can exploit this, via a specially crafted request to disclose potentially sensitive information.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:2538 advisory.

    Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and IMAP protocols, with a strong     focus on high concurrency, performance and low memory usage.

    Security Fix(es):

    * A flaw within the processing of ranged HTTP requests has been discovered in the range filter module of     nginx. A remote attacker could possibly exploit this flaw to disclose parts of the cache file header, or,     if used in combination with third party modules, disclose potentially sensitive memory by sending     specially crafted HTTP requests. (CVE-2017-7529)

    Red Hat would like to thank the Nginx project for reporting this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that there was vulnerability in the range filter of nginx, a web/proxy server. A specially crafted request might result in an integer overflow and incorrect processing of HTTP ranges, potentially resulting in a sensitive information leak.

For Debian 7 'Wheezy', this issue has been fixed in nginx version 1.2.1-2.2+wheezy4+deb7u1.

We recommend that you upgrade your nginx packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update includes nginx 1.12.1, fixing CVE-2017-7529, and adds the http_auth_request module.

See http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.html for more information on CVE-2017-7529.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its Server response header, the installed version of nginx is prior to 1.12.1 or 1.13.x prior to 1.13.3.
It is, therefore, affected by an integer overflow vulnerability in the range filter module. An unauthenticated, remote attacker can exploit this, via a specially crafted request to disclose potentially sensitive information.

This update for nginx to version 1.13.9 fixes the following issues :

  - CVE-2017-7529: nginx: Integer overflow in nginx range     filter module allowed memory disclosure (bsc#1048265)

This update also contains all updates and improvements in 1.13.9 upstream release.

Maxim Dounin reports :

A security issue was identified in nginx range filter. A specially crafted request might result in an integer overflow and incorrect processing of ranges, potentially resulting in sensitive information leak (CVE-2017-7529).

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
140789	Oracle Linux 7 : olcne / nginx (ELSA-2020-5859)	Nessus	Oracle Linux Local Security Checks	2020/9/25	2025/4/15	high
161695	Nginx Plus > R13 Data Disclosure Vulnerability	Nessus	Web Servers	2022/5/31	2025/4/15	high
210313	RHEL 6 / 7 : rh-nginx110-nginx (RHSA-2017:2538)	Nessus	Red Hat Local Security Checks	2024/11/5	2025/4/14	high
101535	Debian DLA-1024-1 : nginx security update	Nessus	Debian Local Security Checks	2017/7/14	2025/12/11	high
102719	Fedora 26 : 1:nginx (2017-aecd25b8a9)	Nessus	Fedora Local Security Checks	2017/8/24	2025/11/26	high
102720	Fedora 25 : 1:nginx (2017-c27a947af1)	Nessus	Fedora Local Security Checks	2017/8/24	2025/11/26	high
118151	nginx Data Disclosure Vulnerability	Nessus	Web Servers	2018/10/16	2025/4/15	high
108639	openSUSE Security Update : nginx (openSUSE-2018-316)	Nessus	SuSE Local Security Checks	2018/3/27	2025/4/15	high
101381	FreeBSD : nginx -- a specially crafted request might result in an integer overflow (b28adc5b-6693-11e7-ad43-f0def16c5c1b)	Nessus	FreeBSD Local Security Checks	2017/7/12	2025/12/12	high

检测

插件搜索

high

high

high

high

high

high

high

high

high