Login
Newsletter
Werbung

Sicherheit: Preisgabe von Informationen in nginx (Aktualisierung)
Aktuelle Meldungen Distributionen
Name: Preisgabe von Informationen in nginx (Aktualisierung)
ID: USN-4235-2
Distribution: Ubuntu
Plattformen: Ubuntu 14.04 ESM
Datum: Mi, 15. Januar 2020, 20:28
Referenzen: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20372
Applikationen: nginx
Update von: Preisgabe von Informationen in nginx

Originalnachricht


--===============6473773386926949605==
Content-Type: multipart/signed; micalg=pgp-sha512;
protocol="application/pgp-signature";
boundary="JgQwtEuHJzHdouWu"
Content-Disposition: inline


--JgQwtEuHJzHdouWu
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

==========================================================================
Ubuntu Security Notice USN-4235-2
January 15, 2020

nginx vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.04 ESM

Summary:

nginx could be made to expose sensitive information over the
network.

Software Description:
- nginx: small, powerful, scalable web/proxy server

Details:

USN-4235-1 fixed a vulnerability in nginx. This update provides
the corresponding update for Ubuntu 14.04 ESM.

Original advisory details:

Bert JW Regeer and Francisco Oca Gonzalez discovered that nginx incorrectly
handled certain error_page configurations. A remote attacker could possibly
use this issue to perform HTTP request smuggling attacks and access
resources contrary to expectations.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.04 ESM:
nginx-common 1.4.6-1ubuntu3.9+esm1
nginx-core 1.4.6-1ubuntu3.9+esm1
nginx-extras 1.4.6-1ubuntu3.9+esm1
nginx-full 1.4.6-1ubuntu3.9+esm1
nginx-light 1.4.6-1ubuntu3.9+esm1

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/4235-2
https://usn.ubuntu.com/4235-1
CVE-2019-20372

--JgQwtEuHJzHdouWu
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEf+ebRFcoyOoAQoOeRbznW4QLH2kFAl4fYFkACgkQRbznW4QL
H2nMRg/8DoVyw7l6+nKTVn5bQzaYy4X57gDt8fMPNzIj0r979LRUuBC8e7/Oy9ie
j+cXc5yVmtvdrlh4juPTZgyyVvB060NcFnCd8LkeK/bj68V1TIznUsSykxy0K+/+
hCHdWgd4GRACsrocbBSR9gkN41JnIAonbiGoyolN4QaQXwWAI9P/Km5UQxfbTcGN
4o0nFcI7e32xcASQ2xLTEHVoE/giqjn4uAk53sB+BsI/mbJUHUwmGZHbMBWri6Ls
oYoVHWgd1ENDWRv6jY9097PW4nvDrlxvnNz6vD7yFJS7YlfI+spmpChwEZ77e5C2
I85dRO3aS+8QMLjwmYAZoBDUd6cLRemNo4BTje6g1Dq2E5ZCtXYaHuj9mCtCpejT
4vFoLG9dVLDIhRQcVrqv8ADoU/QZ3791ZlQGTkg4fpKzFPMCzvvxnCH2kJVP75qG
3Ez2u9wX1ooZEOFCZ7AUSk9Dr2WvP8KY3+8+g/5S9ZBGqPN/pJ0HjfX6ZH66SG7r
tfOXC8UKcme2ci+IyY/p2j+ZjbRcaKJQyELAyFFqSTENU/BiuivTM9YEsQG7oLjG
iKOCkKseIGxMzssGOqe3buDfgp71cECc48kSnp9ixDgcKattF54D/85mQC/u3DEX
igXkPpiSlt9ISwX6x90k1ILNmD++Rg2kO+vXFKcM0UWwMZF9//s=
=pKpd
-----END PGP SIGNATURE-----

--JgQwtEuHJzHdouWu--


--===============6473773386926949605==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
Pro-Linux
Pro-Linux @Twitter
Neue Nachrichten
Werbung