CVE-2020-36309
Last updated 24 July 2024
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2020-36309.
What is the affected software?
The affected software is OpenResty with nginx versions 1.14.0-0ubuntu1.10, 1.18.0-0ubuntu1.3, and 1.10.3-0ubuntu0.16.04.5+.
What is the fix/remedy for this vulnerability?
The fix/remedy for this vulnerability is to update OpenResty/nginx to versions 1.14.0-0ubuntu1.10, 1.18.0-0ubuntu1.3, or 1.10.3-0ubuntu0.16.04.5+ depending on the affected software version.
Can unsafe characters be used in the URI or request/response headers?
Yes, unsafe characters can be used in the URI, request, or response headers when using the ngx_http_lua_module API.
Where can I find more information about this vulnerability?
You can find more information about this vulnerability at the MITRE CVE website (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36309), the OpenResty lua-nginx-module GitHub pull request (https://github.com/openresty/lua-nginx-module/pull/1654), and the Ubuntu security notices (https://ubuntu.com/security/notices/USN-5371-1).