UbuntuUpdates.org

Package "nginx"

Name: nginx

Description:

small, powerful, scalable web/proxy server
Latest version: 1.10.3-0ubuntu0.16.04.5
Release: xenial (16.04)
Level: security
Repository: main
Homepage: http://nginx.net

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "nginx"

All arch deb package
APT INSTALL

Other versions of "nginx" in Xenial

Repository Area Version
base universe 1.9.15-0ubuntu1
base main 1.9.15-0ubuntu1
security universe 1.10.3-0ubuntu0.16.04.5
updates main 1.10.3-0ubuntu0.16.04.5
updates universe 1.10.3-0ubuntu0.16.04.5
PPA: Nginx 1.16.1-0+xenial1

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 1.10.3-0ubuntu0.16.04.5 2020-01-13 16:06:43 UTC

  nginx (1.10.3-0ubuntu0.16.04.5) xenial-security; urgency=medium

  * SECURITY UPDATE: request smuggling via error_page
    - debian/patches/CVE-2019-20372.patch: discard request body when
      redirecting to a URL via error_page in
      src/http/ngx_http_special_response.c.
    - CVE-2019-20372

 -- Marc Deslauriers <email address hidden> Fri, 10 Jan 2020 14:19:02 -0500
Source diff to previous version
CVE-2019-20372 NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read una

Version: 1.10.3-0ubuntu0.16.04.4 2019-08-15 18:07:21 UTC

  nginx (1.10.3-0ubuntu0.16.04.4) xenial-security; urgency=medium

  * SECURITY UPDATE: HTTP/2 Data Dribble issue
    - debian/patches/CVE-2019-9511.patch: limited number of DATA frames in
      src/http/v2/ngx_http_v2.c, src/http/v2/ngx_http_v2.h,
      src/http/v2/ngx_http_v2_filter_module.c.
    - CVE-2019-9511
  * SECURITY UPDATE: HTTP/2 Resource Loop / Priority Shuffling issue
    - debian/patches/CVE-2019-9513.patch: limited number of PRIORITY frames
      in src/http/v2/ngx_http_v2.c, src/http/v2/ngx_http_v2.h.
    - CVE-2019-9513
  * SECURITY UPDATE: HTTP/2 0-Length Headers Leak issue
    - debian/patches/CVE-2019-9516.patch: reject zero length headers with
      PROTOCOL_ERROR in src/http/v2/ngx_http_v2.c.
    - CVE-2019-9516

 -- Marc Deslauriers <email address hidden> Wed, 14 Aug 2019 14:48:49 -0400
Source diff to previous version
CVE-2019-9511 Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of ser
CVE-2019-9513 Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request strea
CVE-2019-9516 Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with

Version: 1.10.3-0ubuntu0.16.04.3 2018-11-07 16:06:19 UTC

  nginx (1.10.3-0ubuntu0.16.04.3) xenial-security; urgency=medium

  * SECURITY UPDATE: excessive memory consumption in HTTP/2 implementation
    - debian/patches/CVE-2018-16843.patch: add flood detection in
      src/http/v2/ngx_http_v2.c, src/http/v2/ngx_http_v2.h.
    - CVE-2018-16843
  * SECURITY UPDATE: excessive CPU usage in HTTP/2 implementation
    - debian/patches/CVE-2018-16844-pre.patch: backport new
      http2_max_requests directive.
    - debian/patches/CVE-2018-16844.patch: limit the number of idle state
      switches in src/http/v2/ngx_http_v2.c, src/http/v2/ngx_http_v2.h.
    - CVE-2018-16844
  * SECURITY UPDATE: infinite loop in ngx_http_mp4_module
    - debian/patches/CVE-2018-16845.patch: fixed reading 64-bit atoms in
      src/http/modules/ngx_http_mp4_module.c.
    - CVE-2018-16845

 -- Marc Deslauriers <email address hidden> Tue, 06 Nov 2018 13:55:13 -0500
Source diff to previous version
CVE-2018-16843 Excessive memory usage in HTTP/2
CVE-2018-16844 Excessive CPU usage in HTTP/2
CVE-2018-16845 Memory disclosure in the ngx_http_mp4_module

Version: 1.10.3-0ubuntu0.16.04.2 2017-07-13 19:07:12 UTC

  nginx (1.10.3-0ubuntu0.16.04.2) xenial-security; urgency=medium

  * SECURITY UPDATE: integer overflow in range filter leading to
    information exposure
    - debian/patches/CVE-2017-7529.patch: add check to ensure size does
      not overflow
    - CVE-2017-7529

 -- Steve Beattie <email address hidden> Wed, 12 Jul 2017 03:20:18 -0700
Source diff to previous version

Version: 1.10.0-0ubuntu0.16.04.4 2016-10-27 22:06:46 UTC

  nginx (1.10.0-0ubuntu0.16.04.4) xenial-security; urgency=medium

  * SECURITY REGRESSION: config upgrade failure (LP: #1637058)
    - debian/nginx-common.config: fix return code so script doesn't exit.

 -- Marc Deslauriers <email address hidden> Thu, 27 Oct 2016 10:42:14 -0400
1637058 nginx-common postinst execution fails when upgrading to or reinstalling 1.10.1-0ubuntu3


About   -   Send Feedback to @ubuntu_updates