{ "document" : { "aggregate_severity" : { "text" : "hoch" }, "category" : "csaf_base", "csaf_version" : "2.0", "distribution" : { "tlp" : { "label" : "WHITE", "url" : "https://www.first.org/tlp/" } }, "lang" : "de-DE", "notes" : [ { "category" : "legal_disclaimer", "text" : "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen." }, { "category" : "description", "text" : "NGINX ist eine Webserver-, Reverse Proxy- und E-Mail-Proxy Software.\r\nNGINX Plus ist die kommerzielle Variante von NGINX, einer Webserver-, Reverse Proxy- und E-Mail Proxy Software.", "title" : "Produktbeschreibung" }, { "category" : "summary", "text" : "Ein Angreifer kann mehrere Schwachstellen in NGINX und NGINX NGINX Plus ausnutzen, um Daten zu manipulieren, beliebigen Code auszuführen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand auszulösen.", "title" : "Angriff" }, { "category" : "general", "text" : "- Sonstiges\n- UNIX\n- Windows", "title" : "Betroffene Betriebssysteme" } ], "publisher" : { "category" : "other", "contact_details" : "csaf-provider@cert-bund.de", "name" : "Bundesamt für Sicherheit in der Informationstechnik", "namespace" : "https://www.bsi.bund.de" }, "references" : [ { "category" : "self", "summary" : "WID-SEC-W-2026-1995 - CSAF Version", "url" : "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1995.json" }, { "category" : "self", "summary" : "WID-SEC-2026-1995 - Portal Version", "url" : "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1995" }, { "category" : "external", "summary" : "GitHub Advisory Database vom 2026-06-17", "url" : "https://github.com/advisories/GHSA-gx48-gh32-62q5" }, { "category" : "external", "summary" : "GitHub Advisory Database vom 2026-06-17", "url" : "https://github.com/advisories/GHSA-vh3x-jr27-wpwh" }, { "category" : "external", "summary" : "GitHub Advisory Database vom 2026-06-17", "url" : "https://github.com/advisories/GHSA-2388-jp8v-fg9w" }, { "category" : "external", "summary" : "GitHub Advisory Database vom 2026-06-17", "url" : "https://github.com/advisories/GHSA-5mcp-3252-f5vr" }, { "category" : "external", "summary" : "GitHub Advisory Database vom 2026-06-17", "url" : "https://github.com/advisories/GHSA-78jw-ww3g-9wp7" }, { "category" : "external", "summary" : "GitHub Advisory Database vom 2026-06-17", "url" : "https://github.com/advisories/GHSA-9566-3h6w-56pp" } ], "source_lang" : "en-US", "title" : "NGINX und NGINX Plus: Mehrere Schwachstellen", "tracking" : { "current_release_date" : "2026-06-17T22:00:00.000+00:00", "generator" : { "date" : "2026-06-18T10:04:52.550+00:00", "engine" : { "name" : "BSI-WID", "version" : "1.6.0" } }, "id" : "WID-SEC-W-2026-1995", "initial_release_date" : "2026-06-17T22:00:00.000+00:00", "revision_history" : [ { "date" : "2026-06-17T22:00:00.000+00:00", "number" : "1", "summary" : "Initiale Fassung" } ], "status" : "final", "version" : "1" } }, "product_tree" : { "branches" : [ { "branches" : [ { "branches" : [ { "category" : "product_version_range", "name" : "Open Source <1.31.2", "product" : { "name" : "NGINX NGINX Open Source <1.31.2", "product_id" : "T055582" } }, { "category" : "product_version", "name" : "Open Source 1.31.2", "product" : { "name" : "NGINX NGINX Open Source 1.31.2", "product_id" : "T055582-fixed", "product_identification_helper" : { "cpe" : "cpe:/a:nginx:nginx:open_source__1.31.2" } } }, { "category" : "product_version", "name" : "Instance Manager", "product" : { "name" : "NGINX NGINX Instance Manager", "product_id" : "T055583", "product_identification_helper" : { "cpe" : "cpe:/a:nginx:nginx:instance_manager" } } }, { "category" : "product_version_range", "name" : "Gateway Fabric <2.6.4", "product" : { "name" : "NGINX NGINX Gateway Fabric <2.6.4", "product_id" : "T055584" } }, { "category" : "product_version", "name" : "Gateway Fabric 2.6.4", "product" : { "name" : "NGINX NGINX Gateway Fabric 2.6.4", "product_id" : "T055584-fixed", "product_identification_helper" : { "cpe" : "cpe:/a:nginx:nginx:gateway_fabric__2.6.4" } } }, { "category" : "product_version", "name" : "Ingress Controller", "product" : { "name" : "NGINX NGINX Ingress Controller", "product_id" : "T055585", "product_identification_helper" : { "cpe" : "cpe:/a:nginx:nginx:ingress_controller" } } }, { "category" : "product_version_range", "name" : "Open Source <1.30.3", "product" : { "name" : "NGINX NGINX Open Source <1.30.3", "product_id" : "T055588" } }, { "category" : "product_version", "name" : "Open Source 1.30.3", "product" : { "name" : "NGINX NGINX Open Source 1.30.3", "product_id" : "T055588-fixed", "product_identification_helper" : { "cpe" : "cpe:/a:nginx:nginx:open_source__1.30.3" } } }, { "category" : "product_version", "name" : "App Protect WAF", "product" : { "name" : "NGINX NGINX App Protect WAF", "product_id" : "T055589", "product_identification_helper" : { "cpe" : "cpe:/a:nginx:nginx:app_protect_waf" } } }, { "category" : "product_version", "name" : "App Protect DoS", "product" : { "name" : "NGINX NGINX App Protect DoS", "product_id" : "T055590", "product_identification_helper" : { "cpe" : "cpe:/a:nginx:nginx:app_protect_dos" } } } ], "category" : "product_name", "name" : "NGINX" }, { "branches" : [ { "category" : "product_version_range", "name" : "<37.0.2.1", "product" : { "name" : "NGINX NGINX Plus <37.0.2.1", "product_id" : "T055586" } }, { "category" : "product_version", "name" : "37.0.2.1", "product" : { "name" : "NGINX NGINX Plus 37.0.2.1", "product_id" : "T055586-fixed", "product_identification_helper" : { "cpe" : "cpe:/a:nginx:nginx_plus:37.0.2.1" } } }, { "category" : "product_version_range", "name" : "