Package "nginx-extras"
| Name: |
nginx-extras
|
Description: |
nginx web/proxy server (extended version)
|
| Latest version: |
1.18.0-0ubuntu1.6 |
| Release: |
focal (20.04) |
| Level: |
security |
| Repository: |
universe |
| Head package: |
nginx |
| Homepage: |
http://nginx.net |
Links
Download "nginx-extras"
Other versions of "nginx-extras" in Focal
Changelog
|
nginx (1.18.0-0ubuntu1.6) focal-security; urgency=medium
* SECURITY UPDATE: DoS in ngx_http_mp4_module
- debian/patches/CVE-2024-7347-1.patch: fixed buffer underread while
updating stsz atom in src/http/modules/ngx_http_mp4_module.c.
- debian/patches/CVE-2024-7347-2.patch: reject unordered chunks in stsc
atom in src/http/modules/ngx_http_mp4_module.c.
- CVE-2024-7347
-- Marc Deslauriers <email address hidden> Tue, 10 Sep 2024 09:52:13 -0400
|
| Source diff to previous version |
| CVE-2024-7347 |
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to over-read NGINX worker memory resu |
|
|
nginx (1.18.0-0ubuntu1.4) focal-security; urgency=medium
* SECURITY UPDATE: memory corruption/disclosure issue
- debian/patches/CVE-2022-41741_41742.patch: disabled duplicate atoms in
Mp4
- CVE-2022-41741
- CVE-2022-41742
-- Nishit Majithia <email address hidden> Thu, 10 Nov 2022 12:08:48 +0530
|
| Source diff to previous version |
| CVE-2022-41741 |
NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R |
| CVE-2022-41742 |
NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R |
|
|
nginx (1.18.0-0ubuntu1.3) focal-security; urgency=medium
* SECURITY UPDATE: ALPACA TLS issue
- debian/patches/CVE-2021-3618.patch: specify the number of
errors after which the connection is closed in
src/mail/ngx_mail.h, src/mail/ngx_mail_core_module.c and
src/mail/ngx_mail_handler.c.
- CVE-2021-3618
* SECURITY UPDATE: request mutation by unsafe characters
- Add input validation to requests in Lua module in
debian/modules/http-lua/src/ngx_http_lua_control.c,
debian/modules/http-lua/src/ngx_http_lua_headers_in.c,
debian/modules/http-lua/src/ngx_http_lua_headers_out.c,
debian/modules/http-lua/src/ngx_http_lua_uri.c,
debian/modules/http-lua/src/ngx_http_lua_util.h and
debian/modules/http-lua/src/ngx_http_lua_util.h.
- CVE-2020-36309
* SECURITY UPDATE: request smuggling in ngx.location.capture
- Add manual crafting of Content-Length in case request is
chunked in
debian/modules/http-lua/src/ngx_http_lua_subrequest.c.
- CVE-2020-11724
-- David Fernandez Gonzalez <email address hidden> Tue, 12 Apr 2022 10:04:16 +0200
|
| Source diff to previous version |
| CVE-2021-3618 |
ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certif |
| CVE-2020-36309 |
ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or |
| CVE-2020-11724 |
An issue was discovered in OpenResty before 1.15.8.4. ngx_http_lua_subrequest.c allows HTTP request smuggling, as demonstrated by the ngx.location.ca |
|
|
nginx (1.18.0-0ubuntu1.2) focal-security; urgency=medium
* SECURITY UPDATE: DNS Resolver issues
- debian/patches/CVE-2021-23017-1.patch: fixed off-by-one write in
src/core/ngx_resolver.c.
- debian/patches/CVE-2021-23017-2.patch: fixed off-by-one read in
src/core/ngx_resolver.c.
- CVE-2021-23017
-- Marc Deslauriers <email address hidden> Tue, 25 May 2021 13:10:38 -0400
|
About
-
Send Feedback to @ubuntu_updates
