CVE-2021-23017
HighPublic exploitnginx - security update
Published Feb 1, 2022 · Updated Sep 8, 2026 · Also known as ALPINE-CVE-2021-23017, BIT-nginx-2021-23017, BIT-nginx-gateway-2021-23017, DEBIAN-CVE-2021-23017, DLA-2670-1, DSA-4921-1, SUSE-SU-2021:1792-1, SUSE-SU-2021:1814-1, SUSE-SU-2021:1815-1, SUSE-SU-2021:1839-1, TR-21-0438, TR-21-0454, UBUNTU-CVE-2021-23017, USN-4967-1, USN-4967-2
Key Facts
Patch immediately- CVE-2021-23017 is a high-severity vulnerability (CVSS 7.7 v3.1) affecting Nginx (F5), Ontap Select Deploy Administration Utility (Netapp), Openresty and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 53% probability of exploitation in the next 30 days.
- Fixed versions are available, including 3scale-amp2/3scale-rhel7-operator-metadata:2.11.0 16, 3scale-amp2/3scale-rhel7-operator:1.14.0 4, 3scale-amp2/apicast-gateway-rhel8:1.20.0 6.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
7.7
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
EPSS (30-day exploit likelihood)
53%
Higher than 98.9% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2021-23017 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.
Affected Products
162 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| NginxF5 | >= 0.6.18 | 1.20.1 |
| Ontap Select Deploy Administration UtilityNetapp | See advisory | n/a |
| OpenrestyOpenresty | See advisory | 1.19.3.2 |
| Blockchain PlatformOracle | See advisory | 21.1.2 |
| Communications Control Plane MonitorOracle | 3.4, 4.2, 4.3, 4.4 | n/a |
Patched Releases
3scale-amp2/3scale-rhel7-operator-metadata:2.11.0
16
3scale-amp2/3scale-rhel7-operator:1.14.0
4
3scale-amp2/apicast-gateway-rhel8:1.20.0
6
3scale-amp2/apicast-rhel7-operator-metadata:2.11.0
9
3scale-amp2/apicast-rhel7-operator:1.14.0
3
3scale-amp2/backend-rhel8:1.14.0
3
3scale-amp2/memcached-rhel7:1.4.16
38
3scale-amp2/system-rhel7:1.15.0
8
3scale-amp2/toolbox-rhel8:1.6.0
7
3scale-amp2/zync-rhel8:1.14.0
3
ansible-tower
38/ansible-tower-rhel7:3.8.4-1
automation-hub
0:4.2.5-1.el7pc, 0:4.2.5-1.el8pc
Nginx
1.20.1, 1:1.16.1-2.0.1.module+el8.4.0+20188+a733e426.1, 1:1.16.1-2.module_el8.4.0+2470+68135136.1.alma, 1:1.16.1-2.module+el8.4.0+543+efbf198b.1, 1:1.18.0-1.43.amzn1, 1:1.18.0-3.0.1.module+el8.4.0+20183+8c128c59.1, 1:1.18.0-3.module_el8.4.0+2472+f736ed63.1.alma, 1:1.18.0-3.module+el8.4.0+544+e40554cf.1, 1:1.20.1-1.0.1.module+el8.5.0+20483+2c28049e, 1:1.20.1-1.module_el8.6.0+2782+a022aca3.alma, 1:1.20.1-1.module+el8.6.0+791+48a2bb9d, 1.10.3-0ubuntu0.16.04.5+esm1, 1.10.3-1+deb9u6, 1.14.0-0ubuntu1.9, 1.14.2-2+deb10u4, 1.16.1-3.15.1, 1.16.1-3.3.1, 1.16.1-3.ph1, 1.16.1-3.ph2, 1.16.1-4.ph3, 1.16.1-6.13.1, 1.16.1-lp152.2.3.1, 1.16.1-r3, 1.16.1-r7, 1.16.1-r8, 1.18.0-0ubuntu1.2, 1.18.0-6.1, 1.18.0-r14, 1.18.0-r15, 1.18.0-r2, 1.18.0-r3, 1.19.3-2.ph4, 1.19.8-3.3.1, 1.20.1-1, 1.20.1-r0, 1.21.3-1.4, 1.4.6-1ubuntu3.9+esm2
nginx-all-modules
1:1.16.1-2.0.1.module+el8.4.0+20188+a733e426.1, 1:1.18.0-1.43.amzn1, 1:1.18.0-3.0.1.module+el8.4.0+20183+8c128c59.1, 1:1.20.1-1.0.1.module+el8.5.0+20483+2c28049e
nginx-filesystem
1:1.16.1-2.0.1.module+el8.4.0+20188+a733e426.1, 1:1.18.0-3.0.1.module+el8.4.0+20183+8c128c59.1, 1:1.20.1-1.0.1.module+el8.5.0+20483+2c28049e
nginx-gateway
1.20.1
nginx-mainline
1.21.0-1
nginx-mod-http-geoip
1:1.18.0-1.43.amzn1
nginx-mod-http-image-filter
1:1.16.1-2.0.1.module+el8.4.0+20188+a733e426.1, 1:1.18.0-1.43.amzn1, 1:1.18.0-3.0.1.module+el8.4.0+20183+8c128c59.1, 1:1.20.1-1.0.1.module+el8.5.0+20483+2c28049e
nginx-mod-http-perl
1:1.16.1-2.0.1.module+el8.4.0+20188+a733e426.1, 1:1.18.0-1.43.amzn1, 1:1.18.0-3.0.1.module+el8.4.0+20183+8c128c59.1, 1:1.20.1-1.0.1.module+el8.5.0+20483+2c28049e
nginx-mod-http-xslt-filter
1:1.16.1-2.0.1.module+el8.4.0+20188+a733e426.1, 1:1.18.0-1.43.amzn1, 1:1.18.0-3.0.1.module+el8.4.0+20183+8c128c59.1, 1:1.20.1-1.0.1.module+el8.5.0+20483+2c28049e
nginx-mod-mail
1:1.16.1-2.0.1.module+el8.4.0+20188+a733e426.1, 1:1.18.0-1.43.amzn1, 1:1.18.0-3.0.1.module+el8.4.0+20183+8c128c59.1, 1:1.20.1-1.0.1.module+el8.5.0+20483+2c28049e
nginx-mod-stream
1:1.16.1-2.0.1.module+el8.4.0+20188+a733e426.1, 1:1.18.0-1.43.amzn1, 1:1.18.0-3.0.1.module+el8.4.0+20183+8c128c59.1, 1:1.20.1-1.0.1.module+el8.5.0+20483+2c28049e
nginx-source
1.16.1-3.3.1, 1.16.1-6.13.1, 1.16.1-lp152.2.3.1, 1.19.8-3.3.1, 1.21.3-1.4
nginx:1.16
8040020210526102347.522a0ee4
Timeline
Publicly disclosed
Feb 1, 2022
Last updated
Sep 8, 2026
Weakness Type
- CWE-193 Off-by-one Error
References
- advisoryhttp://packetstormsecurity.com/files/167720/Nginx-1.20.0-Denial-Of-Service.html
- advisoryRHBA-2021:2955
- advisoryRHBA-2021:3472
- advisoryRHSA-2021:2258
- advisoryRHSA-2021:2259
FAQ
Common Questions.
A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.
Affected: Nginx (F5) versions >= 0.6.18; Ontap Select Deploy Administration Utility (Netapp); Openresty, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including 3scale-amp2/3scale-rhel7-operator-metadata:2.11.0 16, 3scale-amp2/3scale-rhel7-operator:1.14.0 4, 3scale-amp2/apicast-gateway-rhel8:1.20.0 6.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2021-23017 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo