USN-5371-3

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/notices/USN-5371-3

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-5371-3.json

JSON Data

https://api.test.osv.dev/v1/vulns/USN-5371-3

Related

Published

2022-10-07T13:05:55.213505Z

Modified

2022-10-07T13:05:55.213505Z

Summary

nginx vulnerability

Details

USN-5371-1 and USN-5371-2 fixed several vulnerabilities in nginx. This update provides the corresponding update for CVE-2020-11724 for Ubuntu 16.04 ESM.

Original advisory details:

It was discovered that nginx Lua module mishandled certain inputs. An attacker could possibly use this issue to perform an HTTP Request Smuggling attack. This issue was fixed for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-11724)

It was discovered that nginx Lua module mishandled certain inputs. An attacker could possibly use this issue to disclose sensitive information. This issue only affects Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-36309)

It was discovered that nginx mishandled the use of compatible certificates among multiple encryption protocols. If a remote attacker were able to intercept the communication, this issue could be used to redirect traffic between subdomains. (CVE-2021-3618)

References

Affected packages

Ubuntu:Pro:16.04:LTS / nginx

Package

Name: nginx
Purl: pkg:deb/ubuntu/nginx?arch=src?distro=esm-infra/xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.10.3-0ubuntu0.16.04.5+esm4

Affected versions

1.*

1.9.3-1ubuntu1

1.9.6-2ubuntu1

1.9.6-2ubuntu2

1.9.9-0ubuntu1

1.9.9-1ubuntu1

1.9.10-0ubuntu1

1.9.10-1ubuntu1

1.9.11-0ubuntu1

1.9.11-0ubuntu2

1.9.12-0ubuntu1

1.9.13-0ubuntu1

1.9.14-0ubuntu1

1.9.15-0ubuntu1

1.10.0-0ubuntu0.16.04.1

1.10.0-0ubuntu0.16.04.2

1.10.0-0ubuntu0.16.04.3

1.10.0-0ubuntu0.16.04.4

1.10.3-0ubuntu0.16.04.1

1.10.3-0ubuntu0.16.04.2

1.10.3-0ubuntu0.16.04.3

1.10.3-0ubuntu0.16.04.4

1.10.3-0ubuntu0.16.04.5

1.10.3-0ubuntu0.16.04.5+esm1

1.10.3-0ubuntu0.16.04.5+esm2

1.10.3-0ubuntu0.16.04.5+esm3

Ecosystem specific

{
    "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_version": "1.10.3-0ubuntu0.16.04.5+esm4",
            "binary_name": "nginx"
        },
        {
            "binary_version": "1.10.3-0ubuntu0.16.04.5+esm4",
            "binary_name": "nginx-common"
        },
        {
            "binary_version": "1.10.3-0ubuntu0.16.04.5+esm4",
            "binary_name": "nginx-core"
        },
        {
            "binary_version": "1.10.3-0ubuntu0.16.04.5+esm4",
            "binary_name": "nginx-core-dbg"
        },
        {
            "binary_version": "1.10.3-0ubuntu0.16.04.5+esm4",
            "binary_name": "nginx-core-dbgsym"
        },
        {
            "binary_version": "1.10.3-0ubuntu0.16.04.5+esm4",
            "binary_name": "nginx-doc"
        },
        {
            "binary_version": "1.10.3-0ubuntu0.16.04.5+esm4",
            "binary_name": "nginx-extras"
        },
        {
            "binary_version": "1.10.3-0ubuntu0.16.04.5+esm4",
            "binary_name": "nginx-extras-dbg"
        },
        {
            "binary_version": "1.10.3-0ubuntu0.16.04.5+esm4",
            "binary_name": "nginx-extras-dbgsym"
        },
        {
            "binary_version": "1.10.3-0ubuntu0.16.04.5+esm4",
            "binary_name": "nginx-full"
        },
        {
            "binary_version": "1.10.3-0ubuntu0.16.04.5+esm4",
            "binary_name": "nginx-full-dbg"
        },
        {
            "binary_version": "1.10.3-0ubuntu0.16.04.5+esm4",
            "binary_name": "nginx-full-dbgsym"
        },
        {
            "binary_version": "1.10.3-0ubuntu0.16.04.5+esm4",
            "binary_name": "nginx-light"
        },
        {
            "binary_version": "1.10.3-0ubuntu0.16.04.5+esm4",
            "binary_name": "nginx-light-dbg"
        },
        {
            "binary_version": "1.10.3-0ubuntu0.16.04.5+esm4",
            "binary_name": "nginx-light-dbgsym"
        }
    ]
}