UbuntuUpdates.org

Package "nginx"

Name: nginx

Description:

small, powerful, scalable web/proxy server
Latest version: 1.14.0-0ubuntu1.11
Release: bionic (18.04)
Level: security
Repository: main
Homepage: http://nginx.net

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "nginx"

All arch deb package
APT INSTALL

Other versions of "nginx" in Bionic

Repository Area Version
base universe 1.14.0-0ubuntu1
base main 1.14.0-0ubuntu1
security universe 1.14.0-0ubuntu1.11
updates main 1.14.0-0ubuntu1.11
updates universe 1.14.0-0ubuntu1.11
PPA: Nginx 1.18.0-3ubuntu1+bionic1
PPA: Nginx from nginx.org 1.24.0-1~bionic

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 1.14.0-0ubuntu1.4 2019-08-15 18:07:38 UTC

  nginx (1.14.0-0ubuntu1.4) bionic-security; urgency=medium

  * SECURITY UPDATE: HTTP/2 Data Dribble issue
    - debian/patches/CVE-2019-9511.patch: limited number of DATA frames in
      src/http/v2/ngx_http_v2.c, src/http/v2/ngx_http_v2.h,
      src/http/v2/ngx_http_v2_filter_module.c.
    - CVE-2019-9511
  * SECURITY UPDATE: HTTP/2 Resource Loop / Priority Shuffling issue
    - debian/patches/CVE-2019-9513.patch: limited number of PRIORITY frames
      in src/http/v2/ngx_http_v2.c, src/http/v2/ngx_http_v2.h.
    - CVE-2019-9513
  * SECURITY UPDATE: HTTP/2 0-Length Headers Leak issue
    - debian/patches/CVE-2019-9516.patch: reject zero length headers with
      PROTOCOL_ERROR in src/http/v2/ngx_http_v2.c.
    - CVE-2019-9516

 -- Marc Deslauriers <email address hidden> Wed, 14 Aug 2019 14:44:40 -0400
Source diff to previous version
CVE-2019-9511 Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of ser
CVE-2019-9513 Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request strea
CVE-2019-9516 Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with

Version: 1.14.0-0ubuntu1.2 2018-11-07 16:06:21 UTC

  nginx (1.14.0-0ubuntu1.2) bionic-security; urgency=medium

  * SECURITY UPDATE: excessive memory consumption in HTTP/2 implementation
    - debian/patches/CVE-2018-16843.patch: add flood detection in
      src/http/v2/ngx_http_v2.c, src/http/v2/ngx_http_v2.h.
    - CVE-2018-16843
  * SECURITY UPDATE: excessive CPU usage in HTTP/2 implementation
    - debian/patches/CVE-2018-16844.patch: limit the number of idle state
      switches in src/http/v2/ngx_http_v2.c, src/http/v2/ngx_http_v2.h.
    - CVE-2018-16844
  * SECURITY UPDATE: infinite loop in ngx_http_mp4_module
    - debian/patches/CVE-2018-16845.patch: fixed reading 64-bit atoms in
      src/http/modules/ngx_http_mp4_module.c.
    - CVE-2018-16845

 -- Marc Deslauriers <email address hidden> Tue, 06 Nov 2018 13:54:15 -0500
CVE-2018-16843 Excessive memory usage in HTTP/2
CVE-2018-16844 Excessive CPU usage in HTTP/2
CVE-2018-16845 Memory disclosure in the ngx_http_mp4_module


About   -   Send Feedback to @ubuntu_updates