aws-samples / aws-proton-sample-services Goto Github PK

A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact. (CVE-2021-23017)

The nginx:1.19.5 version in the Dockerfile is vulnerable to CVE-2021-23017 which is marked as critical in Amazon Linux Security Center. It is reasonable to also update the sample in order to prevent vulnerable versions from being used again.

Reference:

1. NGINX security advisory (CVE-2021-23017)
2. NVD - CVE-2021-23017
3. Amazon Linux Security Center - ALAS-2021-1507