UbuntuUpdates.org

Package "nginx"

Name: nginx

Description:

small, powerful, scalable web/proxy server
Latest version: 1.14.0-0ubuntu1.11
Release: bionic (18.04)
Level: security
Repository: main
Homepage: http://nginx.net

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "nginx"

All arch deb package
APT INSTALL

Other versions of "nginx" in Bionic

Repository Area Version
base universe 1.14.0-0ubuntu1
base main 1.14.0-0ubuntu1
security universe 1.14.0-0ubuntu1.11
updates main 1.14.0-0ubuntu1.11
updates universe 1.14.0-0ubuntu1.11
PPA: Nginx 1.18.0-3ubuntu1+bionic1
PPA: Nginx from nginx.org 1.24.0-1~bionic

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 1.14.0-0ubuntu1.11 2022-11-15 07:06:47 UTC

  nginx (1.14.0-0ubuntu1.11) bionic-security; urgency=medium

  * SECURITY UPDATE: memory corruption/disclosure issue
    - debian/patches/CVE-2022-41741_41742.patch: disabled duplicate atoms in
      Mp4
    - CVE-2022-41741
    - CVE-2022-41742

 -- Nishit Majithia <email address hidden> Thu, 10 Nov 2022 12:08:23 +0530
Source diff to previous version
CVE-2022-41741 NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R
CVE-2022-41742 NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R

Version: 1.14.0-0ubuntu1.10 2022-04-12 15:06:19 UTC

  nginx (1.14.0-0ubuntu1.10) bionic-security; urgency=medium

  * SECURITY UPDATE: ALPACA TLS issue
    - debian/patches/CVE-2021-3618.patch: specify the number of
      errors after which the connection is closed in
      src/mail/ngx_mail.h, src/mail/ngx_mail_core_module.c and
      src/mail/ngx_mail_handler.c.
    - CVE-2021-3618
  * SECURITY UPDATE: request mutation by unsafe characters
    - Add input validation to requests in Lua module in
      debian/modules/http-lua/src/ngx_http_lua_control.c,
      debian/modules/http-lua/src/ngx_http_lua_headers_in.c,
      debian/modules/http-lua/src/ngx_http_lua_headers_out.c,
      debian/modules/http-lua/src/ngx_http_lua_uri.c,
      debian/modules/http-lua/src/ngx_http_lua_util.h and
      debian/modules/http-lua/src/ngx_http_lua_util.h.
    - CVE-2020-36309
  * SECURITY UPDATE: request smuggling in ngx.location.capture
    - Add manual crafting of Content-Length in case request is
      chunked in
      debian/modules/http-lua/src/ngx_http_lua_subrequest.c.
    - CVE-2020-11724

 -- David Fernandez Gonzalez <email address hidden> Tue, 12 Apr 2022 11:00:15 +0200
Source diff to previous version
CVE-2021-3618 ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certif
CVE-2020-36309 ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or
CVE-2020-11724 An issue was discovered in OpenResty before 1.15.8.4. ngx_http_lua_subrequest.c allows HTTP request smuggling, as demonstrated by the ngx.location.ca

Version: 1.14.0-0ubuntu1.9 2021-05-26 16:06:23 UTC

  nginx (1.14.0-0ubuntu1.9) bionic-security; urgency=medium

  * SECURITY UPDATE: DNS Resolver issues
    - debian/patches/CVE-2021-23017-1.patch: fixed off-by-one write in
      src/core/ngx_resolver.c.
    - debian/patches/CVE-2021-23017-2.patch: fixed off-by-one read in
      src/core/ngx_resolver.c.
    - CVE-2021-23017

 -- Marc Deslauriers <email address hidden> Tue, 25 May 2021 13:11:02 -0400
Source diff to previous version

Version: 1.14.0-0ubuntu1.7 2020-01-13 16:06:46 UTC

  nginx (1.14.0-0ubuntu1.7) bionic-security; urgency=medium

  * SECURITY UPDATE: request smuggling via error_page
    - debian/patches/CVE-2019-20372.patch: discard request body when
      redirecting to a URL via error_page in
      src/http/ngx_http_special_response.c.
    - CVE-2019-20372

 -- Marc Deslauriers <email address hidden> Fri, 10 Jan 2020 14:18:38 -0500
Source diff to previous version
CVE-2019-20372 NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read una

Version: 1.14.0-0ubuntu1.6 2019-08-20 16:06:32 UTC

  nginx (1.14.0-0ubuntu1.6) bionic-security; urgency=medium

  * No change rebuild in -security pocket now that OpenSSL 1.1.1 is
    available.

 -- Marc Deslauriers <email address hidden> Tue, 20 Aug 2019 08:46:02 -0400


About   -   Send Feedback to @ubuntu_updates