CVE-2020-36309: Medium severity openresty vulnerability
Last updated 24 July 2024
Other sources
ngxhttpluamodule (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2020-36309.
What is the affected software?
The affected software is OpenResty with nginx versions 1.14.0-0ubuntu1.10, 1.18.0-0ubuntu1.3, and 1.10.3-0ubuntu0.16.04.5+.
What is the fix/remedy for this vulnerability?
The fix/remedy for this vulnerability is to update OpenResty/nginx to versions 1.14.0-0ubuntu1.10, 1.18.0-0ubuntu1.3, or 1.10.3-0ubuntu0.16.04.5+ depending on the affected software version.
Can unsafe characters be used in the URI or request/response headers?
Yes, unsafe characters can be used in the URI, request, or response headers when using the ngx_http_lua_module API.
Where can I find more information about this vulnerability?
You can find more information about this vulnerability at the MITRE CVE website (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36309), the OpenResty lua-nginx-module GitHub pull request (https://github.com/openresty/lua-nginx-module/pull/1654), and the Ubuntu security notices (https://ubuntu.com/security/notices/USN-5371-1).