Descriptionngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs986787

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libnginx-mod-http-lua (PTS)bookworm1:0.10.23-1fixed
sid, trixie1:0.10.26-3fixed
nginx (PTS)buster1.14.2-2+deb10u4vulnerable
buster (security)1.14.2-2+deb10u5vulnerable
bullseye (security), bullseye1.18.0-6.1+deb11u3vulnerable
sid, trixie1.26.0-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libnginx-mod-http-luasource(unstable)(not affected)


- libnginx-mod-http-lua <not-affected> (Fixed before initial upload to Debian)
[bullseye] - nginx <ignored> (Minor issue, too intrusive to backport, see #986787)
[buster] - nginx <ignored> (Minor issue, too intrusive to backport, see #986787)
[stretch] - nginx <postponed> (Minor issue; can be fixed in next update)
src:nginx/1.22.0-3 removed the http-lua module and moved it to a separate package

Search for package or bug name: Reporting problems