{"id":"CVE-2017-20005","aliases":["CLSA-2021-1635427159","CLSA-2021-1635430310","CLSA-2021-1636378490","DEBIAN-CVE-2017-20005","DLA-2680-1","EUVD-2017-11020","GHSA-6g54-r3q8-8jvq","UBUNTU-CVE-2017-20005","USN-5109-1"],"status":"published","title":"NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a...","description":"NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modification date in 1969 that causes an integer overflow (or a false modification date far in the future), when encountered by the autoindex module.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.03258,"percentile":0.88439,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120","CWE-190"],"published":"2021-06-06T21:04:06Z","modified":"2026-10-20T13:21:50Z","fixes":[{"ecosystem":"TuxCare:OracleLinux:6","package":"nginx","fixed_in":["1.10.3-4.el6.cloudlinux.els"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"nginx-all-modules","fixed_in":["1.10.3-4.el6.cloudlinux.els"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"nginx-filesystem","fixed_in":["1.10.3-4.el6.cloudlinux.els"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"nginx-mod-http-geoip","fixed_in":["1.10.3-4.el6.cloudlinux.els"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"nginx-mod-http-image-filter","fixed_in":["1.10.3-4.el6.cloudlinux.els"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"nginx-mod-http-perl","fixed_in":["1.10.3-4.el6.cloudlinux.els"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"nginx-mod-http-xslt-filter","fixed_in":["1.10.3-4.el6.cloudlinux.els"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"nginx-mod-mail","fixed_in":["1.10.3-4.el6.cloudlinux.els"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"nginx-mod-stream","fixed_in":["1.10.3-4.el6.cloudlinux.els"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx","fixed_in":["1.10.3-0ubuntu0.16.04.8"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-common","fixed_in":["1.10.3-0ubuntu0.16.04.8"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-core","fixed_in":["1.10.3-0ubuntu0.16.04.8"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-doc","fixed_in":["1.10.3-0ubuntu0.16.04.8"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-extras","fixed_in":["1.10.3-0ubuntu0.16.04.8"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-full","fixed_in":["1.10.3-0ubuntu0.16.04.8"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-light","fixed_in":["1.10.3-0ubuntu0.16.04.8"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"nginx","fixed_in":["1.10.3-4.el6.cloudlinux.els"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"nginx-all-modules","fixed_in":["1.10.3-4.el6.cloudlinux.els"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"nginx-filesystem","fixed_in":["1.10.3-4.el6.cloudlinux.els"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"nginx-mod-http-geoip","fixed_in":["1.10.3-4.el6.cloudlinux.els"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"nginx-mod-http-image-filter","fixed_in":["1.10.3-4.el6.cloudlinux.els"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"nginx-mod-http-perl","fixed_in":["1.10.3-4.el6.cloudlinux.els"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"nginx-mod-http-xslt-filter","fixed_in":["1.10.3-4.el6.cloudlinux.els"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"nginx-mod-mail","fixed_in":["1.10.3-4.el6.cloudlinux.els"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"nginx-mod-stream","fixed_in":["1.10.3-4.el6.cloudlinux.els"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"nginx","fixed_in":["1.13.6-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nginx","fixed_in":["1.13.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nginx","fixed_in":["1.13.6-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"nginx","fixed_in":["1.10.3-1+deb9u7"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"nginx","fixed_in":["1.4.6-1ubuntu3.9+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nginx","fixed_in":["1.10.3-0ubuntu0.16.04.5+esm2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.el6.cloudlinux.els"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"nginx-all-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.el6.cloudlinux.els"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"nginx-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.el6.cloudlinux.els"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"nginx-mod-http-geoip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.el6.cloudlinux.els"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"nginx-mod-http-image-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.el6.cloudlinux.els"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"nginx-mod-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.el6.cloudlinux.els"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"nginx-mod-http-xslt-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.el6.cloudlinux.els"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"nginx-mod-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.el6.cloudlinux.els"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"nginx-mod-stream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.el6.cloudlinux.els"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.8"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.8"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.8"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.8"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.8"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-full","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.8"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-light","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.8"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.el6.cloudlinux.els"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"nginx-all-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.el6.cloudlinux.els"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"nginx-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.el6.cloudlinux.els"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"nginx-mod-http-geoip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.el6.cloudlinux.els"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"nginx-mod-http-image-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.el6.cloudlinux.els"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"nginx-mod-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.el6.cloudlinux.els"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"nginx-mod-http-xslt-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.el6.cloudlinux.els"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"nginx-mod-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.el6.cloudlinux.els"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"nginx-mod-stream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.el6.cloudlinux.els"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.6-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.6-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-1+deb9u7"}]}],"versions":["1.10.3-1","1.10.3-1+deb9u1","1.10.3-1+deb9u1~bpo8+1","1.10.3-1+deb9u1~bpo8+2","1.10.3-1+deb9u2","1.10.3-1+deb9u3","1.10.3-1+deb9u4","1.10.3-1+deb9u5","1.10.3-1+deb9u6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-1ubuntu3.9+esm3"}]}],"versions":["1.4.1-3ubuntu1","1.4.3-2ubuntu1","1.4.4-1ubuntu1","1.4.4-2ubuntu1","1.4.4-4ubuntu1","1.4.5-1ubuntu1","1.4.6-1ubuntu2","1.4.6-1ubuntu3","1.4.6-1ubuntu3.1","1.4.6-1ubuntu3.2","1.4.6-1ubuntu3.3","1.4.6-1ubuntu3.4","1.4.6-1ubuntu3.5","1.4.6-1ubuntu3.6","1.4.6-1ubuntu3.7","1.4.6-1ubuntu3.8","1.4.6-1ubuntu3.9","1.4.6-1ubuntu3.9+esm1","1.4.6-1ubuntu3.9+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.5+esm2"}]}],"versions":["1.9.3-1ubuntu1","1.9.6-2ubuntu1","1.9.6-2ubuntu2","1.9.9-0ubuntu1","1.9.9-1ubuntu1","1.9.10-0ubuntu1","1.9.10-1ubuntu1","1.9.11-0ubuntu1","1.9.11-0ubuntu2","1.9.12-0ubuntu1","1.9.13-0ubuntu1","1.9.14-0ubuntu1","1.9.15-0ubuntu1","1.10.0-0ubuntu0.16.04.1","1.10.0-0ubuntu0.16.04.2","1.10.0-0ubuntu0.16.04.3","1.10.0-0ubuntu0.16.04.4","1.10.3-0ubuntu0.16.04.1","1.10.3-0ubuntu0.16.04.2","1.10.3-0ubuntu0.16.04.3","1.10.3-0ubuntu0.16.04.4","1.10.3-0ubuntu0.16.04.5","1.10.3-0ubuntu0.16.04.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-1ubuntu3.9+esm3"}]}],"versions":["1.4.1-3ubuntu1","1.4.3-2ubuntu1","1.4.4-1ubuntu1","1.4.4-2ubuntu1","1.4.4-4ubuntu1","1.4.5-1ubuntu1","1.4.6-1ubuntu2","1.4.6-1ubuntu3","1.4.6-1ubuntu3.1","1.4.6-1ubuntu3.2","1.4.6-1ubuntu3.3","1.4.6-1ubuntu3.4","1.4.6-1ubuntu3.5","1.4.6-1ubuntu3.6","1.4.6-1ubuntu3.7","1.4.6-1ubuntu3.8","1.4.6-1ubuntu3.9","1.4.6-1ubuntu3.9+esm1","1.4.6-1ubuntu3.9+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.5+esm2"}]}],"versions":["1.9.3-1ubuntu1","1.9.6-2ubuntu1","1.9.6-2ubuntu2","1.9.9-0ubuntu1","1.9.9-1ubuntu1","1.9.10-0ubuntu1","1.9.10-1ubuntu1","1.9.11-0ubuntu1","1.9.11-0ubuntu2","1.9.12-0ubuntu1","1.9.13-0ubuntu1","1.9.14-0ubuntu1","1.9.15-0ubuntu1","1.10.0-0ubuntu0.16.04.1","1.10.0-0ubuntu0.16.04.2","1.10.0-0ubuntu0.16.04.3","1.10.0-0ubuntu0.16.04.4","1.10.3-0ubuntu0.16.04.1","1.10.3-0ubuntu0.16.04.2","1.10.3-0ubuntu0.16.04.3","1.10.3-0ubuntu0.16.04.4","1.10.3-0ubuntu0.16.04.5","1.10.3-0ubuntu0.16.04.5+esm1"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"f5","product":"nginx"}],"references":[{"url":"http://nginx.org/en/CHANGES","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","advisory","report"]},{"url":"https://trac.nginx.org/nginx/ticket/1368","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Vendor Advisory","fix","report"]},{"url":"https://github.com/nginx/nginx/commit/0206ebe76f748bb39d9de4dd4b3fce777fdfdccf","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/nginx/nginx/commit/b900cc28fcbb4cf5a32ab62f80b59292e1c85b4b","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/06/msg00009.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","report"]},{"url":"https://security.netapp.com/advisory/ntap-20210805-0006/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-20005"},{"url":"https://security.netapp.com/advisory/ntap-20210805-0006"},{"url":"https://github.com/advisories/GHSA-6g54-r3q8-8jvq"},{"url":"https://errata.cloudlinux.com/ol6/CLSA-2021-1635427159.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16_04/CLSA-2021-1635430310","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/els6/CLSA-2021-1636378490.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-20005","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-20005","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5109-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-20005","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-20005","description":"NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modification date in 1969 that causes an integer overflow (or a false modification date far in the future), when encountered by the autoindex module.","status":"published","published":"2021-06-06T21:04:06Z","modified":"2025-12-05T14:54:13.321Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-120","CWE-190"],"updated_at":"2026-11-02T14:33:11.59359Z"}],"euvd":[{"id":"EUVD-2017-11020","description":"NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modification date in 1969 that causes an integer overflow (or a false modification date far in the future), when encountered by the autoindex module.","status":"published","published":"2021-06-06T21:04:06Z","modified":"2025-12-05T14:54:13Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:49:09.437744Z"}],"ghsa":[{"id":"GHSA-6g54-r3q8-8jvq","title":"NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a...","description":"NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modification date in 1969 that causes an integer overflow (or a false modification date far in the future), when encountered by the autoindex module.","status":"published","published":"2022-05-24T19:04:16Z","modified":"2025-12-05T15:30:25Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-120","CWE-190"],"updated_at":"2026-11-02T15:05:03.911166Z"}],"nvd":[{"id":"CVE-2017-20005","description":"NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modification date in 1969 that causes an integer overflow (or a false modification date far in the future), when encountered by the autoindex module.","status":"published","published":"2021-06-06T22:15:08.417Z","modified":"2026-06-17T01:14:54.577Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-190","CWE-120"],"updated_at":"2026-11-02T14:04:21.160774Z"}],"osv":[{"id":"CVE-2017-20005","description":"NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modification date in 1969 that causes an integer overflow (or a false modification date far in the future), when encountered by the autoindex module.","status":"published","published":"2021-06-06T22:15:08.417Z","modified":"2026-10-20T13:21:50.567502357Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:05.486486Z"},{"id":"DEBIAN-CVE-2017-20005","description":"NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modification date in 1969 that causes an integer overflow (or a false modification date far in the future), when encountered by the autoindex module.","status":"published","published":"2021-06-06T22:15:08.417Z","modified":"2026-09-01T20:03:47.16013353Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:29.100767Z"},{"id":"UBUNTU-CVE-2017-20005","description":"NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modification date in 1969 that causes an integer overflow (or a false modification date far in the future), when encountered by the autoindex module.","status":"published","published":"2021-06-06T22:15:00Z","modified":"2026-02-04T03:49:07.236631Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:14.977781Z"},{"id":"CLSA-2021-1635427159","title":"Fixed CVE-2017-20005 in nginx","description":"- CVE-2017-20005: fix buffer overflow for years that exceed four digits","status":"published","published":"2021-10-28T13:19:19Z","modified":"2026-06-01T00:33:24.160691863Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2021-1635430310","title":"Fix CVE(s): CVE-2017-20005","description":"\n   * SECURITY UPDATE: Fix buffer overflow for years that exceed four digits.\n     - debian/patches/CVE-2017-20005.patch\n     - CVE-2017-20005","status":"published","published":"2021-10-28T14:11:50Z","modified":"2026-06-04T10:04:13.981315Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2021-1636378490","title":"Fix of CVE: CVE-2017-20005","description":"- CVE-2017-20005: fix buffer overflow for years that exceed four digits","status":"published","published":"2021-11-08T13:34:50Z","modified":"2026-06-01T00:32:13.91844423Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"DLA-2680-1","title":"nginx - security update","status":"published","published":"2021-06-07T00:00:00Z","modified":"2026-03-09T01:19:58.681385Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"USN-5109-1","title":"nginx vulnerability","description":"It was discovered that nginx incorrectly handled files with\ncertain modification dates. A remote attacker could possibly\nuse this issue to cause a denial of service or other unspecified\nimpact.\n","status":"published","published":"2021-10-18T11:07:46Z","modified":"2026-06-29T13:49:34.016923525Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}