CVE-2020-36309

ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or...

Original description

The description as published by the source.

ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Bitnami openresty

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.10.16"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2020-36309 nginx Fixed in: 1.22.0-3
Ubuntu UBUNTU-CVE-2020-36309 nginx

References

advisory github.com
advisory github.com
advisory news.ycombinator.com
advisory security.netapp.com
web nvd.nist.gov
web lists.debian.org