UbuntuUpdates.org

Package "nginx-extras"

Name: nginx-extras

Description:

nginx web/proxy server (extended version)
Latest version: 1.14.0-0ubuntu1.11
Release: bionic (18.04)
Level: security
Repository: universe
Head package: nginx
Homepage: http://nginx.net

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "nginx-extras"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "nginx-extras" in Bionic

Repository Area Version
base universe 1.14.0-0ubuntu1
updates universe 1.14.0-0ubuntu1.11
PPA: Nginx 1.18.0-3ubuntu1+bionic1

Changelog

Version: 1.14.0-0ubuntu1.11 2022-11-15 07:06:49 UTC

  nginx (1.14.0-0ubuntu1.11) bionic-security; urgency=medium

  * SECURITY UPDATE: memory corruption/disclosure issue
    - debian/patches/CVE-2022-41741_41742.patch: disabled duplicate atoms in
      Mp4
    - CVE-2022-41741
    - CVE-2022-41742

 -- Nishit Majithia <email address hidden> Thu, 10 Nov 2022 12:08:23 +0530
Source diff to previous version
CVE-2022-41741 NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R
CVE-2022-41742 NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R

Version: 1.14.0-0ubuntu1.10 2022-04-12 20:06:22 UTC

  nginx (1.14.0-0ubuntu1.10) bionic-security; urgency=medium

  * SECURITY UPDATE: ALPACA TLS issue
    - debian/patches/CVE-2021-3618.patch: specify the number of
      errors after which the connection is closed in
      src/mail/ngx_mail.h, src/mail/ngx_mail_core_module.c and
      src/mail/ngx_mail_handler.c.
    - CVE-2021-3618
  * SECURITY UPDATE: request mutation by unsafe characters
    - Add input validation to requests in Lua module in
      debian/modules/http-lua/src/ngx_http_lua_control.c,
      debian/modules/http-lua/src/ngx_http_lua_headers_in.c,
      debian/modules/http-lua/src/ngx_http_lua_headers_out.c,
      debian/modules/http-lua/src/ngx_http_lua_uri.c,
      debian/modules/http-lua/src/ngx_http_lua_util.h and
      debian/modules/http-lua/src/ngx_http_lua_util.h.
    - CVE-2020-36309
  * SECURITY UPDATE: request smuggling in ngx.location.capture
    - Add manual crafting of Content-Length in case request is
      chunked in
      debian/modules/http-lua/src/ngx_http_lua_subrequest.c.
    - CVE-2020-11724

 -- David Fernandez Gonzalez <email address hidden> Tue, 12 Apr 2022 11:00:15 +0200
Source diff to previous version
CVE-2021-3618 ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certif
CVE-2020-36309 ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or
CVE-2020-11724 An issue was discovered in OpenResty before 1.15.8.4. ngx_http_lua_subrequest.c allows HTTP request smuggling, as demonstrated by the ngx.location.ca

Version: 1.14.0-0ubuntu1.9 2021-05-26 18:06:20 UTC

  nginx (1.14.0-0ubuntu1.9) bionic-security; urgency=medium

  * SECURITY UPDATE: DNS Resolver issues
    - debian/patches/CVE-2021-23017-1.patch: fixed off-by-one write in
      src/core/ngx_resolver.c.
    - debian/patches/CVE-2021-23017-2.patch: fixed off-by-one read in
      src/core/ngx_resolver.c.
    - CVE-2021-23017

 -- Marc Deslauriers <email address hidden> Tue, 25 May 2021 13:11:02 -0400
Source diff to previous version

Version: 1.14.0-0ubuntu1.7 2020-01-13 16:06:48 UTC

  nginx (1.14.0-0ubuntu1.7) bionic-security; urgency=medium

  * SECURITY UPDATE: request smuggling via error_page
    - debian/patches/CVE-2019-20372.patch: discard request body when
      redirecting to a URL via error_page in
      src/http/ngx_http_special_response.c.
    - CVE-2019-20372

 -- Marc Deslauriers <email address hidden> Fri, 10 Jan 2020 14:18:38 -0500
Source diff to previous version
CVE-2019-20372 NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read una

Version: 1.14.0-0ubuntu1.6 2019-08-20 16:06:35 UTC

  nginx (1.14.0-0ubuntu1.6) bionic-security; urgency=medium

  * No change rebuild in -security pocket now that OpenSSL 1.1.1 is
    available.

 -- Marc Deslauriers <email address hidden> Tue, 20 Aug 2019 08:46:02 -0400


About   -   Send Feedback to @ubuntu_updates