NGINX before 1.13.6 has a buffer overflow for years that exceed four digits, as demonstrated by a file with a modification date in 1969 that causes an integer overflow (or a false modification date far in the future), when encountered by the autoindex module.

References

• https://nvd.nist.gov/vuln/detail/CVE-2017-20005
• nginx/nginx@0206ebe
• nginx/nginx@b900cc2
• https://lists.debian.org/debian-lts-announce/2021/06/msg00009.html
• https://security.netapp.com/advisory/ntap-20210805-0006/
• https://trac.nginx.org/nginx/ticket/1368
• http://nginx.org/en/CHANGES