CVE-2017-20005

CRITICAL 9.8CVE-2017-20005 · Published 06/06/2021 · updated 17/06/2026

Package	Affected versions	Patched versions
nginx f5	`< 1.13.6`	`1.13.6`

Description

NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modification date in 1969 that causes an integer overflow (or a false modification date far in the future), when encountered by the autoindex module.

References

nginx.org/en/CHANGES · Release Notes
nginx/nginx commit 0206ebe · Patch
nginx/nginx commit b900cc2 · Patch
lists.debian.org/debian-lts-announce/2021/06/msg00009.html · Mailing List
security.netapp.com/advisory/ntap-20210805-0006 · Third Party Advisory
trac.nginx.org/nginx/ticket/1368 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free