Homepage

Resource Exhaustion The advisory has been revoked - it doesn't affect any version of package vim-plugin-nginx  (opens in a new tab)

Threat Intelligence

EPSS
9.85% (96th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-SLES150-VIMPLUGINNGINX-2754820
  • published14 Apr 2022
  • disclosed12 Feb 2019
Report a new vulnerability Found a mistake?

Introduced: 12 Feb 2019

CVE-2018-16845  (opens in a new tab)
CWE-400  (opens in a new tab)

Amendment

The SLES security team deemed this advisory irrelevant for SLES:15.0.

NVD Description

Note: Versions mentioned in the description apply only to the upstream vim-plugin-nginx package and not the vim-plugin-nginx package as distributed by SLES.

nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_module, which might allow an attacker to cause infinite loop in a worker process, cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted mp4 file. The issue only affects nginx if it is built with the ngx_http_mp4_module (the module is not built by default) and the .mp4. directive is used in the configuration file. Further, the attack is only possible if an attacker is able to trigger processing of a specially crafted mp4 file with the ngx_http_mp4_module.

References