Red Hat Security Advisory: nginx security update

Fixed packages 26

Vulnerabilities 3

• High 7.1
  CVE-2022-41742

  NGINX ngx_http_mp4_module vulnerability CVE-2022-41742

  NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to c…

  F5 NGINX Plus NGINX Open Source Subscription NGINX Network devices Debian Ubuntu Azure Linux Alpine
  Oct 19, 2022
• High 7.0
  CVE-2022-41741 Public exploit

  NGINX ngx_http_mp4_module vulnerability CVE-2022-41741

  NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 have a vulnerability in the module ngx_http_mp4_module that might allow a local attacker to c…

  F5 NGINX Plus NGINX Open Source Subscription NGINX Network devices Debian Ubuntu Azure Linux Alpine
  Oct 19, 2022
• Medium 4.7
  CVE-2024-7347

  NGINX MP4 module vulnerability

  NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with…

  F5 NGINX Plus NGINX Open Source nginx Network devices Debian Ubuntu Azure Linux Alpine
  Aug 14, 2024

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2141495
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2141496
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7619.json
• report
  https://access.redhat.com/security/cve/CVE-2022-41741
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-41741
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-41741
• article
  https://nginx.org/en/security_advisories.html
• report
  https://access.redhat.com/security/cve/CVE-2022-41742
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-41742
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-41742
• report
  https://access.redhat.com/security/cve/CVE-2024-7347
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2304966
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-7347
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-7347
• article
  https://my.f5.com/manage/s/article/K000140529