Ubuntu 21.10: 6472-3 High: Apache HTTP Request Tunneling

ubuntu

April 13, 2022

Several security issues were fixed in nginx.

Summary

Several security issues were fixed in nginx.

Software Description:

- nginx: small, powerful, scalable web/proxy server

Details:

It was discovered that nginx Lua module mishandled certain inputs.

An attacker could possibly use this issue to perform an HTTP Request

Smuggling attack. This issue only affects Ubuntu 18.04 LTS and

Ubuntu 20.04 LTS. (CVE-2020-11724)

It was discovered that nginx Lua module mishandled certain inputs.

An attacker could possibly use this issue to disclose sensitive

information. This issue only affects Ubuntu 18.04 LTS and

Ubuntu 20.04 LTS. (CVE-2020-36309)

It was discovered that nginx mishandled the use of

compatible certificates among multiple encryption protocols.

If a remote attacker were able to intercept the communication,

this issue could be used to redirect traffic between subdomains.

(CVE-2021-3618)

Topics Covered

security advisory moderate Ubuntu information disclosure nginx remote attacker HTTP request smuggling

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 21.10:
   nginx-core                      1.18.0-6ubuntu11.1
   nginx-extras                    1.18.0-6ubuntu11.1
   nginx-light                     1.18.0-6ubuntu11.1

Ubuntu 20.04 LTS:
   libnginx-mod-http-lua           1.18.0-0ubuntu1.3
   nginx-core                      1.18.0-0ubuntu1.3
   nginx-extras                    1.18.0-0ubuntu1.3
   nginx-full                      1.18.0-0ubuntu1.3
   nginx-light                     1.18.0-0ubuntu1.3

Ubuntu 18.04 LTS:
   libnginx-mod-http-lua           1.14.0-0ubuntu1.10
   nginx-core                      1.14.0-0ubuntu1.10
   nginx-extras                    1.14.0-0ubuntu1.10
   nginx-full                      1.14.0-0ubuntu1.10
   nginx-light                     1.14.0-0ubuntu1.10

Ubuntu 16.04 ESM:
   nginx-core                      1.10.3-0ubuntu0.16.04.5+esm3
   nginx-extras                    1.10.3-0ubuntu0.16.04.5+esm3
   nginx-light                     1.10.3-0ubuntu0.16.04.5+esm3

In general, a standard system update will make all the necessary changes.