FreshPorts - VuXML

NGINX Team reports:

Several security issues were identified in nginx HTTP/2 implementation which might cause excessive memory consumption and CPU usage (CVE-2019-9511, CVE-2019-9513, CVE-2019-9516). The issues affect nginx compiled with the ngx_http_v2_module (not compiled by default) if the http2 option of the listen directive is used in a configuration file.

< 1.16.1,2

< 1.17.3

NGINX Team reports:

NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.

< 1.16.1_11,2

< 1.17.7

NGINX team reports:

1-byte memory overwrite might occur during DNS server response processing if the "resolver" directive was used, allowing an attacker who is able to forge UDP packets from the DNS server to cause worker process crash or, potentially, arbitrary code execution.

< 1.20.1,2

< 1.21.0

The nginx project reports:

Ivan Fratric of the Google Security Team discovered a bug in nginx, which might allow an attacker to bypass security restrictions in certain configurations by using a specially crafted request, or might have potential other impact (CVE-2013-4547).

ge 0.8.41 lt 1.4.4,1

ge 0.8.41 lt 1.5.7

Maxim Dounin reports:

A security issue was identified in nginx range filter. A specially crafted request might result in an integer overflow and incorrect processing of ranges, potentially resulting in sensitive information leak (CVE-2017-7529).

ge 0.5.6 lt 1.12.1,2

ge 0.5.6 lt 1.13.3

Maxim Dounin reports:

A problem was identified in nginx code responsible for saving client request body to a temporary file. A specially crafted request might result in worker process crash due to a NULL pointer dereference while writing client request body to a temporary file.

ge 1.4.0 lt 1.8.1_3,2

ge 1.10.0,2 lt 1.10.1,2

ge 1.3.9 lt 1.9.15_1

ge 1.10.0 lt 1.11.1

nginx development team reports:

Matthew Daley recently discovered a security problem which may lead to a disclosure of previously freed memory on specially crafted response from an upstream server, potentially resulting in sensitive information leak.

< 1.0.14,1

< 1.1.17

The nginx project reports:

Security: it was possible to reuse SSL sessions in unrelated contexts if a shared SSL session cache or the same TLS session ticket key was used for multiple "server" blocks (CVE-2014-3616).

ge 0.6.0 lt 1.6.2,2

ge 0.5.6 lt 1.7.5

Maxim Dounin reports:

Several problems in nginx resolver were identified, which might allow an attacker to cause worker process crash, or might have potential other impact if the "resolver" directive is used in a configuration file.

< 1.8.1,2

< 1.9.10