{ "document" : { "aggregate_severity" : { "text" : "hoch" }, "category" : "csaf_base", "csaf_version" : "2.0", "distribution" : { "tlp" : { "label" : "WHITE", "url" : "https://www.first.org/tlp/" } }, "lang" : "de-DE", "notes" : [ { "category" : "legal_disclaimer", "text" : "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen." }, { "category" : "description", "text" : "NGINX ist eine Webserver-, Reverse Proxy- und E-Mail-Proxy Software.\r\nNGINX Plus ist die kommerzielle Variante von NGINX, einer Webserver-, Reverse Proxy- und E-Mail Proxy Software.", "title" : "Produktbeschreibung" }, { "category" : "summary", "text" : "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in NGINX und NGINX NGINX Plus ausnutzen, um einen Denial of Service Angriff durchzuführen, und potenziell um beliebigen Programmcode auszuführen.", "title" : "Angriff" }, { "category" : "general", "text" : "- Linux\n- UNIX\n- Windows", "title" : "Betroffene Betriebssysteme" } ], "publisher" : { "category" : "other", "contact_details" : "csaf-provider@cert-bund.de", "name" : "Bundesamt für Sicherheit in der Informationstechnik", "namespace" : "https://www.bsi.bund.de" }, "references" : [ { "category" : "self", "summary" : "WID-SEC-W-2026-1661 - CSAF Version", "url" : "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1661.json" }, { "category" : "self", "summary" : "WID-SEC-2026-1661 - Portal Version", "url" : "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1661" }, { "category" : "external", "summary" : "F5 Security Advisory K000161377 vom 2026-05-25", "url" : "https://my.f5.com/manage/s/article/K000161377" }, { "category" : "external", "summary" : "EUVD Security Advisory vom 2026-05-25", "url" : "https://euvd.enisa.europa.eu/enisa/EUVD-2026-31444" }, { "category" : "external", "summary" : "Ubuntu Security Notice USN-8354-1 vom 2026-06-01", "url" : "https://ubuntu.com/security/notices/USN-8354-1" }, { "category" : "external", "summary" : "Ubuntu Security Notice USN-8375-1 vom 2026-06-03", "url" : "https://ubuntu.com/security/notices/USN-8375-1" }, { "category" : "external", "summary" : "Debian Security Advisory DSA-6326 vom 2026-06-07", "url" : "https://security-tracker.debian.org/tracker/DSA-6326-1" }, { "category" : "external", "summary" : "Amazon Linux Security Advisory ALAS2NGINX1-2026-013 vom 2026-06-08", "url" : "https://alas.aws.amazon.com/AL2/ALAS2NGINX1-2026-013.html" }, { "category" : "external", "summary" : "SUSE Security Update SUSE-SU-2026:2307-1 vom 2026-06-09", "url" : "https://lists.suse.com/pipermail/sle-security-updates/2026-June/026654.html" } ], "source_lang" : "en-US", "title" : "NGINX Open Source und NGINX Plus: Schwachstelle ermöglicht Denial of Service und potenziell Codeausführung", "tracking" : { "current_release_date" : "2026-06-09T22:00:00.000+00:00", "generator" : { "date" : "2026-06-10T07:36:55.142+00:00", "engine" : { "name" : "BSI-WID", "version" : "1.6.0" } }, "id" : "WID-SEC-W-2026-1661", "initial_release_date" : "2026-05-25T22:00:00.000+00:00", "revision_history" : [ { "date" : "2026-05-25T22:00:00.000+00:00", "number" : "1", "summary" : "Initiale Fassung" }, { "date" : "2026-06-01T22:00:00.000+00:00", "number" : "2", "summary" : "Neue Updates von Ubuntu aufgenommen" }, { "date" : "2026-06-04T22:00:00.000+00:00", "number" : "3", "summary" : "Neue Updates von Ubuntu aufgenommen" }, { "date" : "2026-06-07T22:00:00.000+00:00", "number" : "4", "summary" : "Neue Updates von Debian aufgenommen" }, { "date" : "2026-06-08T22:00:00.000+00:00", "number" : "5", "summary" : "Neue Updates von Amazon aufgenommen" }, { "date" : "2026-06-09T22:00:00.000+00:00", "number" : "6", "summary" : "Neue Updates von SUSE aufgenommen" } ], "status" : "final", "version" : "6" } }, "product_tree" : { "branches" : [ { "branches" : [ { "category" : "product_name", "name" : "Amazon Linux 2", "product" : { "name" : "Amazon Linux 2", "product_id" : "398363", "product_identification_helper" : { "cpe" : "cpe:/o:amazon:linux_2:-" } } } ], "category" : "vendor", "name" : "Amazon" }, { "branches" : [ { "category" : "product_name", "name" : "Debian Linux", "product" : { "name" : "Debian Linux", "product_id" : "2951", "product_identification_helper" : { "cpe" : "cpe:/o:debian:debian_linux:-" } } } ], "category" : "vendor", "name" : "Debian" }, { "branches" : [ { "branches" : [ { "category" : "product_version_range", "name" : "Open Source <1.31.1", "product" : { "name" : "NGINX NGINX Open Source <1.31.1", "product_id" : "T054558" } }, { "category" : "product_version", "name" : "Open Source 1.31.1", "product" : { "name" : "NGINX NGINX Open Source 1.31.1", "product_id" : "T054558-fixed", "product_identification_helper" : { "cpe" : "cpe:/a:nginx:nginx:open_source__1.31.1" } } }, { "category" : "product_version_range", "name" : "Open Source <1.30.2", "product" : { "name" : "NGINX NGINX Open Source <1.30.2", "product_id" : "T054559" } }, { "category" : "product_version", "name" : "Open Source 1.30.2", "product" : { "name" : "NGINX NGINX Open Source 1.30.2", "product_id" : "T054559-fixed", "product_identification_helper" : { "cpe" : "cpe:/a:nginx:nginx:open_source__1.30.2" } } } ], "category" : "product_name", "name" : "NGINX" }, { "branches" : [ { "category" : "product_version_range", "name" : "<37.0.1.1", "product" : { "name" : "NGINX NGINX Plus <37.0.1.1", "product_id" : "T054560" } }, { "category" : "product_version", "name" : "37.0.1.1", "product" : { "name" : "NGINX NGINX Plus 37.0.1.1", "product_id" : "T054560-fixed", "product_identification_helper" : { "cpe" : "cpe:/a:nginx:nginx_plus:37.0.1.1" } } }, { "category" : "product_version_range", "name" : "