BIT-openresty-2020-36309
Dashboard / Vulnerabilities / BIT-openresty-2020-36309
Summary:
Details: ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or a request or response header.
References: https://github.com/openresty/lua-nginx-module/compare/v0.10.15...v0.10.16, https://github.com/openresty/lua-nginx-module/pull/1654, https://news.ycombinator.com/item?id=26712562, https://security.netapp.com/advisory/ntap-20210507-0005/, https://nvd.nist.gov/vuln/detail/CVE-2020-36309, https://lists.debian.org/debian-lts-announce/2025/06/msg00026.html
Affected packages
Package
Name: openresty
Purl: pkg:bitnami/openresty
Affected ranges
Type: SEMVER
Events:
Introduced- 0
Fixed -0.10.16
Affected versions
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
