CVE-2022-41741

A vulnerability was found in NGINX's module, ngx_http_mp4_module. This flaw allows a local attacker to corrupt NGINX worker memory, resulting in its termination using a specially crafted audio or video file. The issue affects only NGINX products built with ngx_http_mp4_module when the mp4 directive is used in the configuration file. Further, the attack is possible only if an attacker can trigger the processing of a specially crafted audio or video file with ngx_http_mp4_module.

For affected Red Hat products, the impact of this vulnerability is MODERATE. A local attacker with low privileges who can cause a specially crafted audio or video file to be processed by nginx's ngx_http_mp4_module, when the mp4 directive is configured, can corrupt NGINX worker memory, resulting in worker termination and potentially other impact. Current affects include Red Hat Enterprise Linux nginx streams, Red Hat Software Collections nginx streams, Red Hat Ansible Automation Platform, Ansible Services, Hosted OpenShift, cloud.redhat.com, Other Services, and Community Projects. The current affects also include delegated NOTAFFECTED records for Managed Application Services, one Red Hat Ansible Automation Platform record, and one Red Hat Enterprise Linux 9.7 record; these are outside the vulnerable configuration scope because exploitation requires both ngx_http_mp4_module and use of the mp4 directive. Red Hat and NIST assign CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while CVE.org records 7.0 with higher attack complexity; Red Hat's current impact remains MODERATE.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

A mitigation for this vulnerability would be to disable the ngx_http_mp4_module module in your local Nginx environment.