CVE-2017-7529

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 62.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-07-13 · updated 2026-06-17
Weakness: CWE-190

Description

Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.

Affected products

Apple Xcode: before 13.0 — fixed in 13.0
nginx: from 0.5.6 through 1.12.1; from 1.13.0 through 1.13.2
Puppet Enterprise: before 2016.4.7; from 2017.1.0 through 2017.1.1; from 2017.2.1 through 2017.2.3 — fixed in 2016.4.7

How to fix

Upgrade to a fixed version: Apple Xcode 13.0; Puppet Enterprise 2016.4.7. Check the vendor advisory for mitigations.

References

http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.html
http://seclists.org/fulldisclosure/2021/Sep/36
http://www.securityfocus.com/bid/99534
http://www.securitytracker.com/id/1039238
https://access.redhat.com/errata/RHSA-2017:2538
https://puppet.com/security/cve/cve-2017-7529
https://support.apple.com/kb/HT212818
http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.html
http://seclists.org/fulldisclosure/2021/Sep/36
http://www.securityfocus.com/bid/99534
http://www.securitytracker.com/id/1039238
https://access.redhat.com/errata/RHSA-2017:2538

Get alerted when CVE-2017-7529 or the next vulnerability affects your stack