CVE-2021-23017 - NGINX DNS Resolver Vulnerability - Opengear Products are not affected

A flaw was found in NGINX. An off-by-one error while processing DNS responses allows a network attacker to write a dot character out of bounds in a heap allocated buffer which can allow overwriting the least significant byte of next heap chunk metadata likely leading to a remote code execution in certain circumstances. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

This flaw can be triggered only when `resolver` directive is used in the configuration file of NGINX. This directive is used to configure name servers which are used to resolve names of upstream servers into addresses. When the directive is used, a malicious DNS server or an attacker who can intercept and modify the traffic from the DNS server to the NGINX server, could trigger this flaw.

Lighthouse – not affected

Lighthouse is not affected by this CVE we do not use the `resolver` directive in NGINX.

NetOps Console Servers (OM series) – not affected

NetOps Console Servers are not affected by this CVE we do not use the `resolver` directive in NGINX.

Classic Console Servers (IM, CM, ACM series) – not affected

Classic Console Servers are not affected by this CVE as we do not use NGINX on this product.