BLOG | NGINX

立即升级 NGINX 以应对 DNS 解析程序漏洞(CVE-2021-23017)

NGINX-Part-of-F5-horiz-black-type-RGB
Liam Crilly 缩略图
Liam Crilly
Published May 25, 2021

Today we are releasing updates to NGINX Open Source, NGINX Plus, and NGINX Ingress Controller in response to a recently discovered low‑severity vulnerability in the NGINX implementation of DNS resolution. For full details and mitigation instructions, see the F5 Security Advisory about CVE-2021-23017.

The F5 Security Incident Response Team (SIRT) has assigned the vulnerability a score of 3.7 (Low) on the Common Vulnerability Scoring System (CVSS v3.1) scale. NGINX Engineering has assigned it a score of Medium on its internal scale to be consistent with prior vulnerabilities of similar severity.

The patch for this vulnerability is included in the following software versions:

  • NGINX Open Source 1.20.1 (stable)
  • NGINX Open Source 1.21.0 (mainline)
  • NGINX Plus R23 P1
  • NGINX Plus R24 P1

The following versions of NGINX Ingress Controller include the indicated patched versions of NGINX Open Source and NGINX Plus:

  • NGINX Ingress Controller 1.11.2 – NGINX Plus R23 P1
  • NGINX Ingress Controller 1.11.3 – NGINX Open Source 1.21.0 and NGINX Plus R23 P1

We recommend that you upgrade NGINX Open Source, NGINX Plus, and NGINX Ingress Controller to the latest versions.

For NGINX Plus upgrade instructions, see Upgrading NGINX Plus in the NGINX Plus Admin Guide. NGINX Plus customers can also contact our support team for assistance at https://my.f5.com/.

This vulnerability was discovered and responsibly disclosed to us by Luis Merino, Eric Sesterhenn, and Markus Vervier of X41 D‑Sec GmbH.


"This blog post may reference products that are no longer available and/or no longer supported. For the most current information about available F5 NGINX products and solutions, explore our NGINX product family. NGINX is now part of F5. All previous NGINX.com links will redirect to similar NGINX content on F5.com."