Description
The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service (worker process resource consumption) via vectors related to arbitrary name resolution.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00042.html ↗
- https://bto.bluecoat.com/security-advisory/sa115 ↗
- https://security.gentoo.org/glsa/201606-06 ↗
- http://www.securitytracker.com/id/1034869 ↗
- http://mailman.nginx.org/pipermail/nginx/2016-January/049700.html ↗
- https://access.redhat.com/errata/RHSA-2016:1425 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=1302589 ↗
- http://www.debian.org/security/2016/dsa-3473 ↗
- http://www.ubuntu.com/usn/USN-2892-1 ↗
- https://support.apple.com/kb/HT212818 ↗
- http://seclists.org/fulldisclosure/2021/Sep/36 ↗