nginx security advisory (CVE-2022-41741, CVE-2022-41742)

[Maxim Dounin]

Hello!

Two security issues were identified in the ngx_http_mp4_module, which might
allow an attacker to cause a worker process crash or worker process memory
disclosure by using a specially crafted mp4 file, or might have potential
other impact (CVE-2022-41741, CVE-2022-41742).

The issues only affect nginx if it is built with the ngx_http_mp4_module
(the module is not built by default) and the "mp4" directive is used in
the configuration file.  Further, the attack is only possible if an
attacker is able to trigger processing of a specially crafted mp4 file
with the ngx_http_mp4_module.

The issues affect nginx 1.1.3+, 1.0.7+.
The issues are fixed in 1.23.2, 1.22.1.

Patch for the issues can be found here:

http://nginx.org/download/patch.2022.mp4.txt


-- 
Maxim Dounin
http://nginx.org/