UbuntuUpdates.org

Package "nginx-extras"

Name: nginx-extras

Description:

nginx web/proxy server (extended version)

Latest version: 1.14.0-0ubuntu1.6
Release: bionic (18.04)
Level: security
Repository: universe
Head package: nginx
Homepage: http://nginx.net

Links

Save this URL for the latest version of "nginx-extras": https://www.ubuntuupdates.org/nginx-extras


Download "nginx-extras"


Other versions of "nginx-extras" in Bionic

Repository Area Version
base universe 1.14.0-0ubuntu1
updates universe 1.14.0-0ubuntu1.6
PPA: Nginx 1.16.1-0+bionic1

Changelog

Version: 1.14.0-0ubuntu1.6 2019-08-20 16:06:35 UTC

  nginx (1.14.0-0ubuntu1.6) bionic-security; urgency=medium

  * No change rebuild in -security pocket now that OpenSSL 1.1.1 is
    available.

 -- Marc Deslauriers <email address hidden> Tue, 20 Aug 2019 08:46:02 -0400

Source diff to previous version

Version: 1.14.0-0ubuntu1.4 2019-08-15 18:07:43 UTC

  nginx (1.14.0-0ubuntu1.4) bionic-security; urgency=medium

  * SECURITY UPDATE: HTTP/2 Data Dribble issue
    - debian/patches/CVE-2019-9511.patch: limited number of DATA frames in
      src/http/v2/ngx_http_v2.c, src/http/v2/ngx_http_v2.h,
      src/http/v2/ngx_http_v2_filter_module.c.
    - CVE-2019-9511
  * SECURITY UPDATE: HTTP/2 Resource Loop / Priority Shuffling issue
    - debian/patches/CVE-2019-9513.patch: limited number of PRIORITY frames
      in src/http/v2/ngx_http_v2.c, src/http/v2/ngx_http_v2.h.
    - CVE-2019-9513
  * SECURITY UPDATE: HTTP/2 0-Length Headers Leak issue
    - debian/patches/CVE-2019-9516.patch: reject zero length headers with
      PROTOCOL_ERROR in src/http/v2/ngx_http_v2.c.
    - CVE-2019-9516

 -- Marc Deslauriers <email address hidden> Wed, 14 Aug 2019 14:44:40 -0400

Source diff to previous version
CVE-2019-9511 Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of ser
CVE-2019-9513 Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request strea
CVE-2019-9516 Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with

Version: 1.14.0-0ubuntu1.2 2018-11-07 16:06:21 UTC

  nginx (1.14.0-0ubuntu1.2) bionic-security; urgency=medium

  * SECURITY UPDATE: excessive memory consumption in HTTP/2 implementation
    - debian/patches/CVE-2018-16843.patch: add flood detection in
      src/http/v2/ngx_http_v2.c, src/http/v2/ngx_http_v2.h.
    - CVE-2018-16843
  * SECURITY UPDATE: excessive CPU usage in HTTP/2 implementation
    - debian/patches/CVE-2018-16844.patch: limit the number of idle state
      switches in src/http/v2/ngx_http_v2.c, src/http/v2/ngx_http_v2.h.
    - CVE-2018-16844
  * SECURITY UPDATE: infinite loop in ngx_http_mp4_module
    - debian/patches/CVE-2018-16845.patch: fixed reading 64-bit atoms in
      src/http/modules/ngx_http_mp4_module.c.
    - CVE-2018-16845

 -- Marc Deslauriers <email address hidden> Tue, 06 Nov 2018 13:54:15 -0500

CVE-2018-16843 Excessive memory usage in HTTP/2
CVE-2018-16844 Excessive CPU usage in HTTP/2
CVE-2018-16845 Memory disclosure in the ngx_http_mp4_module



About   -   Send Feedback to @ubuntu_updates