support.f5.com Open in urlscan Pro
104.219.110.145  Public Scan

Form analysis
0 forms found in the DOM

Text Content

Knowledge Centers
 * Security
 * Virtualization and Cloud
 * Software
 * Hardware

Resources
 * Downloads
 * F5 Certification
 * iHealth
 * LearnF5
 * DevCentral
 * Bug Tracker
 * Licensing
 * NGINX Documentation

 * F5.com
 * DevCentral
 * Partners
 * MyF5

   
 * Knowledge Centers
    * Security
      * BIG-IP AFM
      * BIG-IP APM
      * BIG-IP ASM
      * F5 DDoS Hybrid Defender
      * F5 Silverline DDoS Protection
      * F5 Silverline Web App Firewall
      * F5 SSL Orchestrator
      See all
    * 
    * Virtualization and Cloud
      * Amazon Web Services
      * BIG-IP Cloud Edition
      * F5 Cloud Services
      * F5 Silverline DDoS Protection
      * F5 Silverline Web App Firewall
      * Google Cloud
      * Microsoft Azure
      See all
    * 
    * Software
      * BIG-IP APM
      * BIG-IP ASM
      * BIG-IP GTM/DNS
      * BIG-IP LTM
      * BIG-IQ Centralized Management
      * NGINX Controller
      * NGINX Plus
      See all
    * 
    * Hardware
      * BIG-IP i2000 Series
      * BIG-IP i4000 Series
      * BIG-IP i5000 Series
      * BIG-IP i7000 Series
      * BIG-IP i10000 Series
      See all

   
 * Resources
    * Downloads
      * BIG-IP 17.x
      * BIG-IP 16.x
      * BIG-IP 15.x
      * BIG-IP 14.x
      * BIG-IQ
      See all
    * 
    * F5 Certification
      
      * Advance your career with F5 Certification
      iHealth
      
      * Verify the proper operation of your BIG-IP or BIG-IQ system
    * 
    * LearnF5
      
      * Get up to speed with free self-paced courses
      DevCentral
      
      * Join the community of 300,000+ technical peers
    * 
    * Bug Tracker
      
      * Search the Bug Tracker
      Licensing
      
      * Activate an F5 product registration key
      NGINX Documentation
      
      * Product manuals and release notes

Sign Up | Sign In | My Support

Search tips

Nov 11, 2022 AskF5 and My Support are moving to MyF5, the new F5 Support site.
To see details and important dates, refer to K000092555: Moving to MyF5.

Nov 02, 2022 The OpenSSL organization released an OpenSSL disclosure on Nov. 1.
F5 is updating K44030142 with the most current information.

Nov 01, 2022 BIG-IP 13.1.x reaches EoSD on December 31, 2022. Upgrade to 14.1.x
or later to ensure access to software patches beyond this date. See K5903.

Oct 19, 2022 For details about recent vulnerabilities, refer to K30425568:
Overview of F5 vulnerabilities (October 2022).

previous next
    
 1. slide 1 of 4, currently active
    
 2. slide 2 of 4
    
 3. slide 3 of 4
    
 4. slide 4 of 4
    

   
 * AskF5 Home
   
 * K28112382
   


K28112382: NGINX NGX_HTTP_MP4_MODULE VULNERABILITY CVE-2022-41742

SECURITY ADVISORY



Original Publication Date: Oct 19, 2022
Updated Date: Oct 21, 2022

Applies to (see versions):
   
 * Product: BIG-IQ, BIG-IQ Centralized Management
   * 8.2.0, 8.1.0, 8.0.0, 7.1.0
   
 * Product: BIG-IP, BIG-IP AFM, BIG-IP Analytics, BIG-IP APM, BIG-IP ASM, BIG-IP
   DNS, BIG-IP FPS, BIG-IP GTM, BIG-IP Link Controller, BIG-IP LTM, BIG-IP PEM,
   BIG-IP AAM
   * 17.0.0, 16.1.3, 16.1.2, 16.1.1, 16.1.0, 15.1.7, 15.1.6, 15.1.5, 15.1.4,
     15.1.3, 15.1.2, 15.1.1, 15.1.0, 14.1.5, 14.1.4, 14.1.3, 14.1.2, 14.1.0,
     13.1.5, 13.1.4, 13.1.3, 13.1.1, 13.1.0
   
 * Product: F5OS, F5OS-A, F5OS-C
   * 1.5.0, 1.3.2, 1.3.1, 1.3.0, 1.2.0, 1.1.1, 1.1.0, 1.0.1, 1.0.0
   
 * Product: NGINX Products, NGINX Plus, NGINX App Protect WAF, NGINX App Protect
   DoS, NGINX Unit, NGINX Ingress Controller, NGINX Instance Manager, NGINX
   Service Mesh, NGINX Open Source, NGINX Controller, NGINX API Connectivity
   Manager
   * R27, R26, R25, R24, R23, R22, 3.9.1, 3.9.0, 3.8.0, 3.7.0, 3.6.0, 3.5.0,
     3.4.0, 3.3.0, 3.22.5, 3.22.4, 3.22.3, 3.22.2, 3.22.1, 3.22.0, 3.21.0,
     3.20.1, 3.20.0, 3.2.0, 3.19.4-APIM, 3.19.3-APIM, 3.19.2-APIM, 3.19.1-APIM,
     3.19.0-APIM, 3.18.3, 3.18.2, 3.18.1-APIM, 3.18.1, 3.18.0-APIM, 3.18.0,
     3.17.0, 3.16.1, 3.15.0, 3.14.0, 3.13.0, 3.12.1, 3.12.0, 3.11.0, 3.10.0,
     3.1.0, 3.0.0, 2.5.1, 2.5.0, 2.4.1, 2.4.0, 2.3.1, 2.3.0, 2.2.2, 2.2.1,
     2.2.0, 2.1.2, 2.1.1, 2.1.0, 2.0.3, 2.0.2, 2.0.1, 2.0.0, 1.9.1, 1.9.0,
     1.5.0, 1.4.1, 1.4.0, 1.3.1, 1.3.0, 1.28.0, 1.27.0, 1.26.1, 1.26.0, 1.25.0,
     1.24.0, 1.23.0, 1.22.0, 1.21.0, 1.20.0, 1.2.0, 1.12.5, 1.12.4, 1.12.3,
     1.12.2, 1.12.1, 1.12.0, 1.11.2, 1.11.1, 1.11.0, 1.10.1, 1.10.0, 1.1.1,
     1.1.0, 1.0.4, 1.0.3, 1.0.2, 1.0.1, 1.0.0
   
 * Product: 5G Products, BIG-IP SPK
   * 1.5.0
   
 * Product: Traffix SDC
   * 5.2.0, 5.1.0
   
 * Product: F5 App Protect, F5 SSL Orchestrator, F5 DDoS Hybrid Defender
   * 17.0.0, 16.1.3, 16.1.2, 16.1.1, 16.1.0, 15.1.1, 15.1.0, 14.1.4, 14.1.2,
     14.1.0
   

SECURITY ADVISORY DESCRIPTION

NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source
Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27
P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might
allow a local attacker to cause a worker process crash, or might result in
worker process memory disclosure by using a specially crafted audio or video
file. The issue affects only NGINX products that are built with the module
ngx_http_mp4_module, when the mp4 directive is used in the configuration file.
Further, the attack is possible only if an attacker can trigger processing of a
specially crafted audio or video file with the module ngx_http_mp4_module.
(CVE-2022-41742)

The ngx_http_mp4_module module provides pseudo-streaming server-side support for
MP4 files. Such files typically have the .mp4, .m4v, or .m4a filename
extensions. For more information about the ngx_http_mp4_module module, refer to
the Module ngx_http_mp4_module page.

Impact

A successful exploit may allow a local attacker to cause an NGINX worker process
to terminate or may allow an NGINX worker process memory disclosure.

Note: The MP4 module is not included by default and must be explicitly enabled
for NGINX Open Source edition. The MP4 module is included in NGINX Plus and
NGINX Open Source Subscription.

SECURITY ADVISORY STATUS

F5 Product Development has assigned NWA-1396 (NGINX Open Source, NGINX Open
Source Subscription, NGINX Plus, and NGINX Ingress Controller) to this
vulnerability. This issue has been classified as CWE-125: Out-of-bounds Read.

To determine if your product and version have been evaluated for this
vulnerability, refer to the Applies to (see versions) box. To determine if your
release is known to be vulnerable, the components or features that are affected
by the vulnerability, and for information about releases, point releases, or
hotfixes that address the vulnerability, refer to the following tables. You can
also use iHealth to diagnose a vulnerability for BIG-IP and BIG-IQ systems. For
more information about using iHealth, refer to K27404821: Using F5 iHealth to
diagnose vulnerabilities. For more information about security advisory
versioning, refer to K51812227: Understanding security advisory versioning.

In this section

 * BIG-IP and BIG-IQ
 * F5OS
 * NGINX
 * Other Products

BIG-IP and BIG-IQ

Note: After a fix is introduced for a given minor branch, that fix applies to
all subsequent maintenance and point releases for that branch, and no additional
fixes for that branch will be listed in the table. For example, when a fix is
introduced in 14.1.2.3, the fix also applies to 14.1.2.4, and all later 14.1.x
releases (14.1.3.x., 14.1.4.x). For more information, refer to K51812227:
Understanding security advisory versioning.

Product Branch Versions known to be vulnerable1 Fixes introduced in Severity
CVSSv3 score2 Vulnerable component or feature BIG-IP (all modules) All None Not
applicable Not vulnerable None None BIG-IP SPK All None Not applicable Not
vulnerable None None BIG-IQ Centralized Management All None Not applicable Not
vulnerable None None

1F5 evaluates only software versions that have not yet reached the End of
Technical Support (EoTS) phase of their lifecycle. For more information, refer
to the Security hotfixes section of K4602: Overview of the F5 security
vulnerability response policy.

2The CVSSv3 score link takes you to a resource outside of AskF5, and it is
possible that the document may be removed without our knowledge.

F5OS

Product Branch Versions known to be vulnerable1 Fixes introduced in Severity
CVSSv3 score2 Vulnerable component or feature F5OS-A All None Not applicable Not
vulnerable None None F5OS-C All None Not applicable Not vulnerable None None

1F5 evaluates only software versions that have not yet reached the End of
Technical Support (EoTS) phase of their lifecycle. For more information, refer
to the Security hotfixes section of K4602: Overview of the F5 security
vulnerability response policy.

2The CVSSv3 score link takes you to a resource outside of AskF5, and it is
possible that the document may be removed without our knowledge.

NGINX

Product Branch Versions known to be vulnerable1 Fixes introduced in Severity
CVSSv3 score2 Vulnerable component or feature NGINX Plus R22 - R27 R22 - R27 R27
P1
R26 P1 High 7.1 Module ngx_http_mp4_module NGINX Open Source Subscription R1 -
R2 R1 - R2 R2 P1
R1 P1 High 7.1 Module ngx_http_mp4_module NGINX Open Source 1.x 1.23.0 - 1.23.1
1.1.3 - 1.22.0 1.23.2
1.22.1 High 7.1 Module ngx_http_mp4_module NGINX Ingress Controller 2.x 2.0.0 -
2.4.0 2.4.1 High 7.1 Module ngx_http_mp4_module3 1.x 1.9.0 - 1.12.4 1.12.5 NGINX
(all other products) All None Not applicable Not vulnerable None None

1F5 evaluates only software versions that have not yet reached the End of
Technical Support (EoTS) phase of their lifecycle. For more information, refer
to the Security hotfixes section of K4602: Overview of the F5 security
vulnerability response policy.

2The CVSSv3 score link takes you to a resource outside of AskF5, and it is
possible that the document may be removed without our knowledge.

3NGINX Ingress Controller pre-built images include NGINX Plus or NGINX Open
Source versions that may be affected by this issue.

Other Products

Product Branch Versions known to be vulnerable1 Fixes introduced in Severity
CVSSv3 score2 Vulnerable component or feature Traffix SDC All None Not
applicable Not vulnerable None None

1F5 evaluates only software versions that have not yet reached the End of
Technical Support (EoTS) phase of their lifecycle. For more information, refer
to the Security hotfixes section of K4602: Overview of the F5 security
vulnerability response policy.

2The CVSSv3 score link takes you to a resource outside of AskF5, and it is
possible that the document may be removed without our knowledge.

RECOMMENDED ACTIONS

If you are running a version listed in the Versions known to be vulnerable
column, you can eliminate this vulnerability by installing a version listed in
the Fixes introduced in column. If the Fixes introduced in column does not list
a version for your branch, then no update candidate currently exists for that
branch and F5 recommends that you upgrade to a version with the fix (refer to
the tables).

If the Fixes introduced in column lists a version prior to the one you are
running, in the same branch, then your version should have the fix.

Mitigation

To mitigate this vulnerability for affected products, restrict publishing of
audio and video files to trusted users only. Optionally, you can disable the MP4
module in your NGINX configuration, until you are able to update your product
version. To do so, perform the following procedure:

Impact of action: The following procedure disables the server-side
pseudo-streaming support for MP4 files, provided by this module. F5 recommends
testing these changes during a maintenance window with consideration to the
possible impact on your specific environment.

 1. Log in to the command line of your NGINX host system with administrative
    privileges.
 2. Change directories to your NGINX configuration directory, usually in
    /etc/nginx.
    
    Note: The configuration can be stubbed out to multiple files, so be sure to
    review all appropriate configuration sections.

 3. Using your preferred text editor, locate all configuration blocks containing
    mp4 directives and enter a hash character (#) at the beginning of the line
    to comment out the directive. For example:
    
    Note: If there are multiple configuration blocks with mp4 directives, F5
    recommends testing changes one at a time. Additionally, mp4 directives are
    supported in the http, server, and location contexts.
    
    location /video/ {
        # mp4;
        # mp4_buffer_size       1m;
        # mp4_max_buffer_size   5m;
        # mp4_limit_rate        on;
        # mp4_limit_rate_after  30s;
    }

 4. Save changes and exit the text editor.
 5. Test configuration changes by entering the following command:
    
    sudo nginx -t

 6. The output should appear similar to the following example:
    
    nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
    nginx: configuration file /etc/nginx/nginx.conf test is successful

 7. Reload the NGINX configuration by entering the following command:
    
    sudo service nginx reload

ACKNOWLEDGEMENTS

This issue was reported to F5 by a source that chooses to remain anonymous.

SUPPLEMENTAL INFORMATION

 * K41942608: Overview of security advisory articles
 * K4602: Overview of the F5 security vulnerability response policy
 * K4918: Overview of the F5 critical issue hotfix policy
 * K8986: F5 product support policies
 * K9970: Subscribing to email notifications regarding F5 products
 * K9957: Creating a custom RSS feed to view new and updated documents
 * NGINX Plus Releases page
 * NGINX Open Source Subscription Releases page
 * NGINX Open Source download page
 * NGINX Ingress Controller Releases page

Applies to:

Product: BIG-IQ, BIG-IQ Centralized Management
8.2.0, 8.1.0, 8.0.0, 7.1.0

Product: BIG-IP, BIG-IP AFM, BIG-IP Analytics, BIG-IP APM, BIG-IP ASM, BIG-IP
DNS, BIG-IP FPS, BIG-IP GTM, BIG-IP Link Controller, BIG-IP LTM, BIG-IP PEM,
BIG-IP AAM
17.0.0, 16.1.3, 16.1.2, 16.1.1, 16.1.0, 15.1.7, 15.1.6, 15.1.5, 15.1.4, 15.1.3,
15.1.2, 15.1.1, 15.1.0, 14.1.5, 14.1.4, 14.1.3, 14.1.2, 14.1.0, 13.1.5, 13.1.4,
13.1.3, 13.1.1, 13.1.0

Product: F5OS, F5OS-A, F5OS-C
1.5.0, 1.3.2, 1.3.1, 1.3.0, 1.2.0, 1.1.1, 1.1.0, 1.0.1, 1.0.0

Product: NGINX Products, NGINX Plus, NGINX App Protect WAF, NGINX App Protect
DoS, NGINX Unit, NGINX Ingress Controller, NGINX Instance Manager, NGINX Service
Mesh, NGINX Open Source, NGINX Controller, NGINX API Connectivity Manager
R27, R26, R25, R24, R23, R22, 3.9.1, 3.9.0, 3.8.0, 3.7.0, 3.6.0, 3.5.0, 3.4.0,
3.3.0, 3.22.5, 3.22.4, 3.22.3, 3.22.2, 3.22.1, 3.22.0, 3.21.0, 3.20.1, 3.20.0,
3.2.0, 3.19.4-APIM, 3.19.3-APIM, 3.19.2-APIM, 3.19.1-APIM, 3.19.0-APIM, 3.18.3,
3.18.2, 3.18.1-APIM, 3.18.1, 3.18.0-APIM, 3.18.0, 3.17.0, 3.16.1, 3.15.0,
3.14.0, 3.13.0, 3.12.1, 3.12.0, 3.11.0, 3.10.0, 3.1.0, 3.0.0, 2.5.1, 2.5.0,
2.4.1, 2.4.0, 2.3.1, 2.3.0, 2.2.2, 2.2.1, 2.2.0, 2.1.2, 2.1.1, 2.1.0, 2.0.3,
2.0.2, 2.0.1, 2.0.0, 1.9.1, 1.9.0, 1.5.0, 1.4.1, 1.4.0, 1.3.1, 1.3.0, 1.28.0,
1.27.0, 1.26.1, 1.26.0, 1.25.0, 1.24.0, 1.23.0, 1.22.0, 1.21.0, 1.20.0, 1.2.0,
1.12.5, 1.12.4, 1.12.3, 1.12.2, 1.12.1, 1.12.0, 1.11.2, 1.11.1, 1.11.0, 1.10.1,
1.10.0, 1.1.1, 1.1.0, 1.0.4, 1.0.3, 1.0.2, 1.0.1, 1.0.0

Product: 5G Products, BIG-IP SPK
1.5.0

Product: Traffix SDC
5.2.0, 5.1.0

Product: F5 App Protect, F5 SSL Orchestrator, F5 DDoS Hybrid Defender
17.0.0, 16.1.3, 16.1.2, 16.1.1, 16.1.0, 15.1.1, 15.1.0, 14.1.4, 14.1.2, 14.1.0




QUICK TASKS

 * AskF5 YouTube Channel
 * Diagnose your system with iHealth
 * Create service request
 * Manage service requests
 * Find serial number
 * Search Bug Tracker
 * New and updated articles
 * Subscribe to mailing lists
 * Contact Support
   
   


SUPPORT PROGRAMS

Regionally located support centers enable F5 to provide support in a number of
languages through native-speaking support engineers.

See more


CONTACT SUPPORT

North America: 1-888-882-7535 or 1-855-834-0367
Outside North America: 800-11-275-435

Local Support Numbers


FEEDBACK AND HELP

Have questions, suggestions, or just want to get something off your chest? Let
us know.

Leave feedback

HAVE A QUESTION?

|Support and Sales >

FOLLOW US

 * 
 * 
 * 
 * 
 * 

--------------------------------------------------------------------------------

ABOUT F5

 * Corporate Information
 * Newsroom
 * Investor Relations
 * Careers
 * About AskF5

EDUCATION

 * Training
 * Certification
 * LearnF5
 * Free Online Training

F5 SITES

 * F5.com
 * DevCentral
 * Support Portal
 * Partner Central
 * F5 Labs

SUPPORT TASKS

 * Read Support Policies
 * Create Service Request
 * Leave feedback [+]

© 2022 F5, Inc. All rights reserved.

Trademarks | Policies | Privacy | California Privacy | Do Not Sell My Personal
Information | Cookie Preferences

rev: 1.5.20221017.3.

Scroll To Top

We value your privacy
To provide the best experience, we leverage third-party technologies to
personalize what you see, and to better understand what content is important to
you. View our privacy policy for details.
Customize Settings No thanks Count me in