UbuntuUpdates.org

Package "nginx"

Name: nginx

Description:

This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • PAM authentication module for Nginx
  • Purge content from Nginx caches
  • WebDAV missing commands support for Nginx
  • Bring echo and more shell style goodies to Nginx

Latest version: 1.18.0-0ubuntu1.4
Release: focal (20.04)
Level: updates
Repository: universe

Links



Other versions of "nginx" in Focal

Repository Area Version
base main 1.17.10-0ubuntu1
security main 1.18.0-0ubuntu1.4
security universe 1.18.0-0ubuntu1.4
updates main 1.18.0-0ubuntu1.4
PPA: Nginx from nginx.org 1.24.0-1~focal

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 1.18.0-0ubuntu1.4 2022-11-15 08:06:25 UTC

  nginx (1.18.0-0ubuntu1.4) focal-security; urgency=medium

  * SECURITY UPDATE: memory corruption/disclosure issue
    - debian/patches/CVE-2022-41741_41742.patch: disabled duplicate atoms in
      Mp4
    - CVE-2022-41741
    - CVE-2022-41742

 -- Nishit Majithia <email address hidden> Thu, 10 Nov 2022 12:08:48 +0530

Source diff to previous version
CVE-2022-41741 NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R
CVE-2022-41742 NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R

Version: 1.18.0-0ubuntu1.3 2022-04-12 17:06:24 UTC

  nginx (1.18.0-0ubuntu1.3) focal-security; urgency=medium

  * SECURITY UPDATE: ALPACA TLS issue
    - debian/patches/CVE-2021-3618.patch: specify the number of
      errors after which the connection is closed in
      src/mail/ngx_mail.h, src/mail/ngx_mail_core_module.c and
      src/mail/ngx_mail_handler.c.
    - CVE-2021-3618
  * SECURITY UPDATE: request mutation by unsafe characters
    - Add input validation to requests in Lua module in
      debian/modules/http-lua/src/ngx_http_lua_control.c,
      debian/modules/http-lua/src/ngx_http_lua_headers_in.c,
      debian/modules/http-lua/src/ngx_http_lua_headers_out.c,
      debian/modules/http-lua/src/ngx_http_lua_uri.c,
      debian/modules/http-lua/src/ngx_http_lua_util.h and
      debian/modules/http-lua/src/ngx_http_lua_util.h.
    - CVE-2020-36309
  * SECURITY UPDATE: request smuggling in ngx.location.capture
    - Add manual crafting of Content-Length in case request is
      chunked in
      debian/modules/http-lua/src/ngx_http_lua_subrequest.c.
    - CVE-2020-11724

 -- David Fernandez Gonzalez <email address hidden> Tue, 12 Apr 2022 10:04:16 +0200

Source diff to previous version
CVE-2021-3618 ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certif
CVE-2020-36309 ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when using the API to mutate a URI, or
CVE-2020-11724 An issue was discovered in OpenResty before 1.15.8.4. ngx_http_lua_subrequest.c allows HTTP request smuggling, as demonstrated by the ngx.location.ca

Version: 1.18.0-0ubuntu1.2 2021-05-26 16:06:31 UTC

  nginx (1.18.0-0ubuntu1.2) focal-security; urgency=medium

  * SECURITY UPDATE: DNS Resolver issues
    - debian/patches/CVE-2021-23017-1.patch: fixed off-by-one write in
      src/core/ngx_resolver.c.
    - debian/patches/CVE-2021-23017-2.patch: fixed off-by-one read in
      src/core/ngx_resolver.c.
    - CVE-2021-23017

 -- Marc Deslauriers <email address hidden> Tue, 25 May 2021 13:10:38 -0400

Source diff to previous version

Version: 1.18.0-0ubuntu1 2020-07-02 13:06:46 UTC

  nginx (1.18.0-0ubuntu1) focal; urgency=medium

  * Stable Release Update for Version String (LP: #1875231)
  * New upstream Stable release (1.18.0) - full changelog available from
    http://nginx.org/en/CHANGES
  * Remaining Ubuntu-specific changes:
    - debian/patches/ubuntu-branding.patch: add Ubuntu branding (refreshed)
    - d/{control,rules,nginx-core.*}: add new binary package for main,
      nginx-core, which contains only source-tarball-included modules
      and no third-party modules.
    - debian/tests/control: add nginx-core test.
    - debian/apport/source_nginx.py: Add apport hooks for additional bug
      information gathering.
    - debian/nginx-common.install: Add install rule for apport hooks.
    - d/nginx-{core,light,full,extras}.postinst: Add checks for whether
      port 80 is in use or not to determine whether or not to attempt
      starting of the NGINX service during install/upgrade
    - d/control: Add dependencies to nginx-{core,light,full,extras} on
      `iproute2` as the postinst scripts now use `ss` to determine if
      Port 80 is open or not.
    - d/rules: Enable --with-compat build option for all nginx package
      flavors
    - d/{control,rules,copyright,modules/http-geoip2*}: Add GeoIP2 third party
      module to nginx-full and nginx-extras (and use proper DEP5 syntax for
      d/copyright).
    - d/control, d/rules: Drop GeoIP from nginx-core due to demotion of
      libgeoip.

 -- Thomas Ward <email address hidden> Tue, 21 Apr 2020 10:49:01 -0400

1875231 [SRU] [20.04] Update NGINX version string to 1.18.0



About   -   Send Feedback to @ubuntu_updates