CVE-2017-20005

NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modification date in 1969 that causes an integer overflow (or a false modification date far in the future), when encountered by the autoindex module.

Database specific

{
    "unresolved_ranges": [
        {
            "source": "CPE_STRING",
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
            ],
            "vendor_product": "debian:debian_linux",
            "extracted_events": [
                {
                    "introduced": "9.0"
                },
                {
                    "last_affected": "9.0"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/nginx/nginx

Affected ranges

Type

GIT

Repo

https://github.com/nginx/nginx

Events

Introduced

Fixed

66ca1d7bd8298ab9887c986781d0ee9675b0c57d

Fixed

0206ebe76f748bb39d9de4dd4b3fce777fdfdccf

Fixed

b900cc28fcbb4cf5a32ab62f80b59292e1c85b4b

Database specific

{
    "cpe": "cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.13.6"
        }
    ]
}

Affected versions

release-0.*

release-0.1.0

release-0.1.1

release-0.1.10

release-0.1.11

release-0.1.12

release-0.1.13

release-0.1.14

release-0.1.15

release-0.1.16

release-0.1.17

release-0.1.18

release-0.1.19

release-0.1.2

release-0.1.20

release-0.1.21

release-0.1.22

release-0.1.23

release-0.1.24

release-0.1.25

release-0.1.26

release-0.1.27

release-0.1.28

release-0.1.29

release-0.1.3

release-0.1.30

release-0.1.31

release-0.1.32

release-0.1.33

release-0.1.34

release-0.1.35

release-0.1.36

release-0.1.37

release-0.1.38

release-0.1.39

release-0.1.4

release-0.1.40

release-0.1.41

release-0.1.42

release-0.1.43

release-0.1.44

release-0.1.45

release-0.1.5

release-0.1.6

release-0.1.7

release-0.1.8

release-0.1.9

release-0.2.0

release-0.2.1

release-0.2.2

release-0.2.3

release-0.2.4

release-0.2.5

release-0.2.6

release-0.3.0

release-0.3.1

release-0.3.10

release-0.3.11

release-0.3.12

release-0.3.13

release-0.3.14

release-0.3.15

release-0.3.16

release-0.3.17

release-0.3.18

release-0.3.19

release-0.3.2

release-0.3.20

release-0.3.21

release-0.3.22

release-0.3.23

release-0.3.24

release-0.3.25

release-0.3.26

release-0.3.27

release-0.3.28

release-0.3.29

release-0.3.3

release-0.3.30

release-0.3.31

release-0.3.32

release-0.3.33

release-0.3.34

release-0.3.35

release-0.3.36

release-0.3.37

release-0.3.38

release-0.3.39

release-0.3.4

release-0.3.40

release-0.3.41

release-0.3.42

release-0.3.43

release-0.3.44

release-0.3.45

release-0.3.46

release-0.3.47

release-0.3.48

release-0.3.49

release-0.3.5

release-0.3.50

release-0.3.51

release-0.3.52

release-0.3.53

release-0.3.54

release-0.3.55

release-0.3.56

release-0.3.57

release-0.3.58

release-0.3.59

release-0.3.6

release-0.3.60

release-0.3.61

release-0.3.7

release-0.3.8

release-0.3.9

release-0.4.0

release-0.4.1

release-0.4.10

release-0.4.11

release-0.4.12

release-0.4.13

release-0.4.14

release-0.4.2

release-0.4.3

release-0.4.4

release-0.4.5

release-0.4.6

release-0.4.7

release-0.4.8

release-0.4.9

release-0.5.0

release-0.5.1

release-0.5.10

release-0.5.11

release-0.5.12

release-0.5.13

release-0.5.14

release-0.5.15

release-0.5.16

release-0.5.17

release-0.5.18

release-0.5.19

release-0.5.2

release-0.5.20

release-0.5.21

release-0.5.22

release-0.5.23

release-0.5.24

release-0.5.25

release-0.5.3

release-0.5.4

release-0.5.5

release-0.5.6

release-0.5.7

release-0.5.8

release-0.5.9

release-0.6.0

release-0.6.1

release-0.6.10

release-0.6.11

release-0.6.12

release-0.6.13

release-0.6.14

release-0.6.15

release-0.6.16

release-0.6.17

release-0.6.18

release-0.6.19

release-0.6.2

release-0.6.20

release-0.6.21

release-0.6.22

release-0.6.23

release-0.6.24

release-0.6.25

release-0.6.26

release-0.6.27

release-0.6.28

release-0.6.29

release-0.6.3

release-0.6.30

release-0.6.31

release-0.6.4

release-0.6.5

release-0.6.6

release-0.6.7

release-0.6.8

release-0.6.9

release-0.7.0

release-0.7.1

release-0.7.10

release-0.7.11

release-0.7.12

release-0.7.13

release-0.7.14

release-0.7.15

release-0.7.16

release-0.7.17

release-0.7.18

release-0.7.19

release-0.7.2

release-0.7.20

release-0.7.21

release-0.7.22

release-0.7.23

release-0.7.24

release-0.7.25

release-0.7.26

release-0.7.27

release-0.7.28

release-0.7.29

release-0.7.3

release-0.7.30

release-0.7.31

release-0.7.32

release-0.7.33

release-0.7.34

release-0.7.35

release-0.7.36

release-0.7.37

release-0.7.38

release-0.7.39

release-0.7.4

release-0.7.40

release-0.7.41

release-0.7.42

release-0.7.43

release-0.7.44

release-0.7.45

release-0.7.46

release-0.7.47

release-0.7.48

release-0.7.49

release-0.7.5

release-0.7.50

release-0.7.51

release-0.7.52

release-0.7.53

release-0.7.54

release-0.7.55

release-0.7.56

release-0.7.57

release-0.7.58

release-0.7.59

release-0.7.6

release-0.7.7

release-0.7.8

release-0.7.9

release-0.8.0

release-0.8.1

release-0.8.10

release-0.8.11

release-0.8.12

release-0.8.13

release-0.8.14

release-0.8.15

release-0.8.16

release-0.8.17

release-0.8.18

release-0.8.19

release-0.8.2

release-0.8.20

release-0.8.21

release-0.8.22

release-0.8.23

release-0.8.24

release-0.8.25

release-0.8.26

release-0.8.27

release-0.8.28

release-0.8.29

release-0.8.3

release-0.8.30

release-0.8.31

release-0.8.32

release-0.8.33

release-0.8.34

release-0.8.35

release-0.8.36

release-0.8.37

release-0.8.38

release-0.8.39

release-0.8.4

release-0.8.40

release-0.8.41

release-0.8.42

release-0.8.43

release-0.8.44

release-0.8.45

release-0.8.46

release-0.8.47

release-0.8.48

release-0.8.49

release-0.8.5

release-0.8.50

release-0.8.51

release-0.8.52

release-0.8.53

release-0.8.6

release-0.8.7

release-0.8.8

release-0.8.9

release-0.9.0

release-0.9.1

release-0.9.2

release-0.9.3

release-0.9.4

release-0.9.5

release-0.9.6

release-0.9.7

release-1.*

release-1.0.0

release-1.0.1

release-1.0.2

release-1.0.3

release-1.0.4

release-1.0.5

release-1.1.0

release-1.1.1

release-1.1.10

release-1.1.11

release-1.1.12

release-1.1.13

release-1.1.14

release-1.1.15

release-1.1.16

release-1.1.17

release-1.1.18

release-1.1.19

release-1.1.2

release-1.1.3

release-1.1.4

release-1.1.5

release-1.1.6

release-1.1.7

release-1.1.8

release-1.1.9

release-1.11.0

release-1.11.1

release-1.11.10

release-1.11.11

release-1.11.12

release-1.11.13

release-1.11.2

release-1.11.3

release-1.11.4

release-1.11.5

release-1.11.6

release-1.11.7

release-1.11.8

release-1.11.9

release-1.13.0

release-1.13.1

release-1.13.2

release-1.13.3

release-1.13.4

release-1.13.5

release-1.2.0

release-1.3.0

release-1.3.1

release-1.3.10

release-1.3.11

release-1.3.12

release-1.3.13

release-1.3.14

release-1.3.15

release-1.3.16

release-1.3.2

release-1.3.3

release-1.3.4

release-1.3.5

release-1.3.6

release-1.3.7

release-1.3.8

release-1.3.9

release-1.4.0

release-1.5.0

release-1.5.1

release-1.5.10

release-1.5.11

release-1.5.12

release-1.5.13

release-1.5.2

release-1.5.3

release-1.5.4

release-1.5.5

release-1.5.6

release-1.5.7

release-1.5.8

release-1.5.9

release-1.7.0

release-1.7.1

release-1.7.10

release-1.7.11

release-1.7.12

release-1.7.2

release-1.7.3

release-1.7.4

release-1.7.5

release-1.7.6

release-1.7.7

release-1.7.8

release-1.7.9

release-1.9.0

release-1.9.1

release-1.9.10

release-1.9.11

release-1.9.12

release-1.9.13

release-1.9.14

release-1.9.15

release-1.9.2

release-1.9.3

release-1.9.4

release-1.9.5

release-1.9.6

release-1.9.7

release-1.9.8

release-1.9.9

Database specific

vanir_signatures

[
    {
        "digest": {
            "length": 954.0,
            "function_hash": "293745260880302260283390811779397824234"
        },
        "signature_version": "v1",
        "source": "https://github.com/nginx/nginx/commit/0206ebe76f748bb39d9de4dd4b3fce777fdfdccf",
        "signature_type": "Function",
        "target": {
            "function": "ngx_gmtime",
            "file": "src/core/ngx_times.c"
        },
        "id": "CVE-2017-20005-12765fb7",
        "deprecated": false
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "37588762136811330033074117254741645493",
                "111209216128424196797059434246210239092",
                "98693140202448203048304883280104112253"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/nginx/nginx/commit/b900cc28fcbb4cf5a32ab62f80b59292e1c85b4b",
        "signature_type": "Line",
        "target": {
            "file": "src/core/ngx_times.c"
        },
        "id": "CVE-2017-20005-1325f535",
        "deprecated": false
    },
    {
        "digest": {
            "length": 961.0,
            "function_hash": "317045738056605005010604687115756241645"
        },
        "signature_version": "v1",
        "source": "https://github.com/nginx/nginx/commit/b900cc28fcbb4cf5a32ab62f80b59292e1c85b4b",
        "signature_type": "Function",
        "target": {
            "function": "ngx_gmtime",
            "file": "src/core/ngx_times.c"
        },
        "id": "CVE-2017-20005-b8597391",
        "deprecated": false
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "283647955193824656164418729188562737248",
                "189195171931257442418315937708627504419",
                "167636579516610846178920746557246670594",
                "326015414903035413461299330815021167909",
                "53713957463048725167029389610515505399",
                "43300747572034154487194778189189219315",
                "14008719561519033426361797626160661323",
                "199959541468589506083450323703511189662",
                "26431161033443707096591012429462889355",
                "102878010187977122764595214866563315881",
                "121718354356566928725733153498047312059",
                "92758879232259713116006360265233425168"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/nginx/nginx/commit/0206ebe76f748bb39d9de4dd4b3fce777fdfdccf",
        "signature_type": "Line",
        "target": {
            "file": "src/core/ngx_times.c"
        },
        "id": "CVE-2017-20005-cdbd1329",
        "deprecated": false
    }
]

vanir_signatures_modified

"2026-07-08T11:48:11Z"

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-20005.json"