2 lines
7.9 KiB
JSON
2 lines
7.9 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"NGINX Open Source","vendor":"F5","versions":[{"changes":[{"at":"1.28.2","status":"unaffected"}],"lessThan":"1.29.5","status":"affected","version":"1.3.0","versionType":"semver"}]},{"defaultStatus":"unknown","product":"NGINX Plus","vendor":"F5","versions":[{"lessThan":"R36 P2","status":"affected","version":"R36","versionType":"custom"},{"lessThan":"R35 P1","status":"affected","version":"R35","versionType":"custom"},{"lessThan":"*","status":"affected","version":"R34","versionType":"custom"},{"lessThan":"*","status":"affected","version":"R33","versionType":"custom"},{"lessThan":"R32 P4","status":"affected","version":"R32","versionType":"custom"}]}],"source":"f5sirt@f5.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:*","matchCriteriaId":"AE3A85CC-50DD-4BE7-A8BF-F2AA2744FCDB","versionEndIncluding":"1.6.2","versionStartIncluding":"1.2.0","vulnerable":true},{"criteria":"cpe:2.3:a:f5:nginx_gateway_fabric:*:*:*:*:*:*:*:*","matchCriteriaId":"95483FC6-1850-4C56-95C6-D65AEF39C5E4","versionEndExcluding":"2.4.1","versionStartIncluding":"2.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*","matchCriteriaId":"53459EB1-5EAE-4F38-86CC-303408A91124","versionEndIncluding":"3.7.2","versionStartIncluding":"3.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*","matchCriteriaId":"73A1CDBB-49F6-4AB6-AA67-542FD8017D6A","versionEndIncluding":"4.0.1","versionStartIncluding":"4.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:f5:nginx_ingress_controller:*:*:*:*:*:*:*:*","matchCriteriaId":"48DC8DC2-497F-48F9-A68B-8EA8DAA507E0","versionEndExcluding":"5.3.3","versionStartIncluding":"5.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:f5:nginx_instance_manager:*:*:*:*:*:*:*:*","matchCriteriaId":"05880D9D-7C68-42A8-9374-8BF4E6403757","versionEndIncluding":"2.21.0","versionStartIncluding":"2.15.1","vulnerable":true},{"criteria":"cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:*","matchCriteriaId":"156F74E8-589F-43FC-AD64-74E2BFD11A62","versionEndExcluding":"1.28.2","versionStartIncluding":"1.3.0","vulnerable":true},{"criteria":"cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:*","matchCriteriaId":"6205FEE4-C23C-4FBA-953D-35E8B8644D64","versionEndExcluding":"1.29.5","versionStartIncluding":"1.29.0","vulnerable":true},{"criteria":"cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:*","matchCriteriaId":"E7600A88-7651-4D8E-A04A-3AA81C850CC5","versionEndExcluding":"r35","versionStartIncluding":"r33","vulnerable":true},{"criteria":"cpe:2.3:a:f5:nginx_plus:r32:-:*:*:*:*:*:*","matchCriteriaId":"36C4308E-651E-437C-84E7-10C542E3ADC2","vulnerable":true},{"criteria":"cpe:2.3:a:f5:nginx_plus:r32:p1:*:*:*:*:*:*","matchCriteriaId":"FA913184-EAAD-409E-99C6-AB979DAA93F3","vulnerable":true},{"criteria":"cpe:2.3:a:f5:nginx_plus:r32:p2:*:*:*:*:*:*","matchCriteriaId":"782DF180-1101-4D6A-A1D7-8DADBAF6D9D3","vulnerable":true},{"criteria":"cpe:2.3:a:f5:nginx_plus:r32:p3:*:*:*:*:*:*","matchCriteriaId":"FB0B11F2-4748-492B-9906-F8C4C5EAFF12","vulnerable":true},{"criteria":"cpe:2.3:a:f5:nginx_plus:r33:p1:*:*:*:*:*:*","matchCriteriaId":"46DC49B8-7286-4867-9CDA-1C1B469CD304","vulnerable":true},{"criteria":"cpe:2.3:a:f5:nginx_plus:r33:p2:*:*:*:*:*:*","matchCriteriaId":"43477C2E-7485-4146-B25C-F58D632CD85B","vulnerable":true},{"criteria":"cpe:2.3:a:f5:nginx_plus:r33:p3:*:*:*:*:*:*","matchCriteriaId":"6A25B9CF-02C0-42DE-9C70-F2AD3ACE3CEB","vulnerable":true},{"criteria":"cpe:2.3:a:f5:nginx_plus:r34:p1:*:*:*:*:*:*","matchCriteriaId":"7453D683-FCA7-46EE-BE49-5FD9A01D7F87","vulnerable":true},{"criteria":"cpe:2.3:a:f5:nginx_plus:r34:p2:*:*:*:*:*:*","matchCriteriaId":"A977BF9F-D165-4B93-B4D2-A177883A5E75","vulnerable":true},{"criteria":"cpe:2.3:a:f5:nginx_plus:r35:-:*:*:*:*:*:*","matchCriteriaId":"5D5FFD66-35C3-41AD-BD77-510E34A3AC6F","vulnerable":true},{"criteria":"cpe:2.3:a:f5:nginx_plus:r36:-:*:*:*:*:*:*","matchCriteriaId":"E7E5F940-048A-446F-9A1E-074612CEA1AC","vulnerable":true},{"criteria":"cpe:2.3:a:f5:nginx_plus:r36:p1:*:*:*:*:*:*","matchCriteriaId":"7993A0FB-BE7E-4634-BF7F-FDEE3582D3E7","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated."},{"lang":"es","value":"Una vulnerabilidad existe en NGINX OSS y NGINX Plus cuando está configurado para actuar como proxy hacia servidores upstream de Transport Layer Security (TLS). Un atacante con una posición de man-in-the-middle (MitM) en el lado del servidor upstream —junto con condiciones fuera del control del atacante— podría ser capaz de inyectar datos en texto plano en la respuesta de un servidor proxy upstream. Nota: Las versiones de software que han alcanzado el Fin del Soporte Técnico (EoTS) no son evaluadas."}],"id":"CVE-2026-1642","lastModified":"2026-06-17T10:16:14.457","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"},"exploitabilityScore":2.2,"impactScore":3.6,"source":"f5sirt@f5.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":8.2,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"f5sirt@f5.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-1642","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-02-04T16:01:47.913148Z","version":"2.0.3"}}]},"published":"2026-02-04T15:16:14.190","references":[{"source":"f5sirt@f5.com","tags":["Vendor Advisory"],"url":"https://my.f5.com/manage/s/article/K000159824"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"],"url":"http://www.openwall.com/lists/oss-security/2026/02/05/1"}],"sourceIdentifier":"f5sirt@f5.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-349"}],"source":"f5sirt@f5.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-345"}],"source":"nvd@nist.gov","type":"Primary"}]}
|