Ubuntu 4235-1: Critical Nginx Information Exposure Risk

ubuntu

January 13, 2020

nginx could be made to expose sensitive information over the network.

Summary

nginx could be made to expose sensitive information over the network.

Software Description:

- nginx: small, powerful, scalable web/proxy server

Details:

Bert JW Regeer and Francisco Oca Gonzalez discovered that nginx incorrectly

handled certain error_page configurations. A remote attacker could possibly

use this issue to perform HTTP request smuggling attacks and access

resources contrary to expectations.

Topics Covered

security advisory network security information exposure ubuntu nginx HTTP request smuggling

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.10:
  nginx-common                    1.16.1-0ubuntu2.1
  nginx-core                      1.16.1-0ubuntu2.1
  nginx-extras                    1.16.1-0ubuntu2.1
  nginx-full                      1.16.1-0ubuntu2.1
  nginx-light                     1.16.1-0ubuntu2.1

Ubuntu 19.04:
  nginx-common                    1.15.9-0ubuntu1.2
  nginx-core                      1.15.9-0ubuntu1.2
  nginx-extras                    1.15.9-0ubuntu1.2
  nginx-full                      1.15.9-0ubuntu1.2
  nginx-light                     1.15.9-0ubuntu1.2

Ubuntu 18.04 LTS:
  nginx-common                    1.14.0-0ubuntu1.7
  nginx-core                      1.14.0-0ubuntu1.7
  nginx-extras                    1.14.0-0ubuntu1.7
  nginx-full                      1.14.0-0ubuntu1.7
  nginx-light                     1.14.0-0ubuntu1.7

Ubuntu 16.04 LTS:
  nginx-common                    1.10.3-0ubuntu0.16.04.5
  nginx-core                      1.10.3-0ubuntu0.16.04.5
  nginx-extras                    1.10.3-0ubuntu0.16.04.5
  nginx-full                      1.10.3-0ubuntu0.16.04.5
  nginx-light                     1.10.3-0ubuntu0.16.04.5

In general, a standard system update will make all the necessary changes.