Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -4 articles for you...
89
security advisoryfedoraFedoraFedora 41: 2025-66ebd291f8 urgent: nginx Denial of Service vulnerability
Changes with nginx 1.26.3 05 Feb 2025 *) Security: insufficient check in virtual servers handling with TLSv1.3 SNI allowed to reuse SSL sessions in a different virtual server, to bypass client SSL certificates verification (CVE-2025-23419). *) Bugfix: in the ngx_http_mp4_module.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-66ebd291f8 2025-02-15 02:35:33.711202+00:00 -------------------------------------------------------------------------------- Name : nginx-mod-fancyindex Product : Fedora 41 Version : 0.5.2 Release : 10.fc41 URL : https://github.com/aperezdc/ngx-fancyindex Summary : Nginx FancyIndex module Description : The Fancy Index module makes possible the generation of file listings, like the built-in autoindex module does, but adding a touch of style. This is possible because the module allows a certain degree of customization of the generated content: * Custom headers. Either local or stored remotely. * Custom footers. Either local or stored remotely. * Add you own CSS style rules. * Allow choosing to sort elements by name (default), modification time, or size; both ascending (default), or descending. -------------------------------------------------------------------------------- Update Information: Changes with nginx 1.26.3 05 Feb 2025 *) Security: insufficient check in virtual servers handling with TLSv1.3 SNI allowed to reuse SSL sessions in a different virtual server, to bypass client SSL certificates verification (CVE-2025-23419). *) Bugfix: in the ngx_http_mp4_module. Thanks to Nils Bars. *) Workaround: "gzip filter failed to use preallocated memory" alerts appeared in logs when using zlib-ng. *) Bugfix: nginx could not build libatomic library using the library sources if the --with-libatomic=DIR option was used. *) Bugfix: nginx now ignores QUIC version negotiationpackets from clients. *) Bugfix: nginx could not be built on Solaris 10 and earlier with the ngx_http_v3_module. *) Bugfixes in HTTP/3. -------------------------------------------------------------------------------- ChangeLog: * Thu Feb 6 2025 Felix Kaechele - 0.5.2-10 - Rebuild for nginx 1.26.3 * Fri Jan 17 2025 Fedora Release Engineering - 0.5.2-9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2277663 - please switch to using systemd-sysusers to create the nginx user https://bugzilla.redhat.com/show_bug.cgi?id=2277663 [ 2 ] Bug #2344198 - CVE-2025-23419 nginx: TLS Session Resumption Vulnerability [fedora-41] https://bugzilla.redhat.com/show_bug.cgi?id=2344198 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-66ebd291f8' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Feb 15, 2025 •Critical Fedora 89
security advisorysecurity issueFedoraFedora 40: 2025-016ed44ddc moderate: nginx TLS session bypass
Changes with nginx 1.26.3 05 Feb 2025 *) Security: insufficient check in virtual servers handling with TLSv1.3 SNI allowed to reuse SSL sessions in a different virtual server, to bypass client SSL certificates verification (CVE-2025-23419). *) Bugfix: in the ngx_http_mp4_module.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-016ed44ddc 2025-02-15 02:22:06.812098+00:00 -------------------------------------------------------------------------------- Name : nginx-mod-fancyindex Product : Fedora 40 Version : 0.5.2 Release : 8.fc40 URL : Summary : Nginx FancyIndex module Description : The Fancy Index module makes possible the generation of file listings, like the built-in autoindex module does, but adding a touch of style. This is possible because the module allows a certain degree of customization of the generated content: * Custom headers. Either local or stored remotely. * Custom footers. Either local or stored remotely. * Add you own CSS style rules. * Allow choosing to sort elements by name (default), modification time, or size; both ascending (default), or descending. -------------------------------------------------------------------------------- Update Information: Changes with nginx 1.26.3 05 Feb 2025 *) Security: insufficient check in virtual servers handling with TLSv1.3 SNI allowed to reuse SSL sessions in a different virtual server, to bypass client SSL certificates verification (CVE-2025-23419). *) Bugfix: in the ngx_http_mp4_module. Thanks to Nils Bars. *) Workaround: "gzip filter failed to use preallocated memory" alerts appeared in logs when using zlib-ng. *) Bugfix: nginx could not build libatomic library using the library sources if the --with-libatomic=DIR option was used. *) Bugfix: nginx now ignores QUIC version negotiation packets from clients. *) Bugfix: nginxcould not be built on Solaris 10 and earlier with the ngx_http_v3_module. *) Bugfixes in HTTP/3. -------------------------------------------------------------------------------- ChangeLog: * Thu Feb 6 2025 Felix Kaechele - 0.5.2-8 - Rebuild for nginx 1.26.3 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2277663 - please switch to using systemd-sysusers to create the nginx user https://bugzilla.redhat.com/show_bug.cgi?id=2277663 [ 2 ] Bug #2344197 - CVE-2025-23419 nginx: TLS Session Resumption Vulnerability [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2344197 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-016ed44ddc' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Feb 15, 2025 Fedora 
89
security advisoryfedoracrash riskUbuntu 23.10: Critical Apache Server Vulnerability Found in 2024-c5g67h8d9c
Security: processing of a specially crafted mp4 file by the ngx_http_mp4_module might cause a worker process crash (CVE-2024-7347). Thanks to Nils Bars.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2024-6ba57fd2a3 2024-08-26 02:04:05.151864 -------------------------------------------------------------------------------- Name : nginx-mod-modsecurity Product : Fedora 40 Version : 1.0.3 Release : 13.fc40 URL : https://github.com/owasp-modsecurity/ModSecurity-nginx Summary : ModSecurity v3 nginx connector Description : The ModSecurity-nginx connector is the connection point between nginx and libmodsecurity (ModSecurity v3). Said another way, this project provides a communication channel between nginx and libmodsecurity. This connector is required to use LibModSecurity with nginx. The ModSecurity-nginx connector takes the form of an nginx module. The module simply serves as a layer of communication between nginx and ModSecurity -------------------------------------------------------------------------------- Update Information: Security: processing of a specially crafted mp4 file by the ngx_http_mp4_module might cause a worker process crash (CVE-2024-7347). Thanks to Nils Bars. -------------------------------------------------------------------------------- ChangeLog: * Sat Aug 17 2024 Felix Kaechele - 1.0.3-13 - Rebuild for nginx 1.26.2 * Thu Jul 18 2024 Fedora Release Engineering - 1.0.3-12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2305156 - CVE-2024-7347 nginx: Nginx: Specially crafted file may cause Denial of Service [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2305156 -------------------------------------------------------------------------------- This update can be installedwith the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-6ba57fd2a3' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Aug 26, 2024 •Critical Fedora 89
security advisoryFedoraDenial of ServiceFedora 40: FEDORA-2024-6ba57fd2a3 Moderate: nginx Worker Crash due to mp4
Security: processing of a specially crafted mp4 file by the ngx_http_mp4_module might cause a worker process crash (CVE-2024-7347). Thanks to Nils Bars.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2024-6ba57fd2a3 2024-08-26 02:04:05.151864 -------------------------------------------------------------------------------- Name : nginx-mod-vts Product : Fedora 40 Version : 0.2.2 Release : 9.fc40 URL : https://github.com/vozlt/nginx-module-vts Summary : Nginx virtual host traffic status module Description : Nginx virtual host traffic status module. -------------------------------------------------------------------------------- Update Information: Security: processing of a specially crafted mp4 file by the ngx_http_mp4_module might cause a worker process crash (CVE-2024-7347). Thanks to Nils Bars. -------------------------------------------------------------------------------- ChangeLog: * Sat Aug 17 2024 Felix Kaechele - 0.2.2-9 - Rebuild for nginx 1.26.2 * Thu Jul 18 2024 Fedora Release Engineering - 0.2.2-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild -------------------------------------------------------------------------------- References: [ 1 ] Bug #2305156 - CVE-2024-7347 nginx: Nginx: Specially crafted file may cause Denial of Service [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2305156 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2024-6ba57fd2a3' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be foundat https://fedoraproject.org/security/ -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Aug 26, 2024 Fedora 98
security advisorymoderatesecurity issueRed Hat Enterprise Linux 8 RHSA-2020:5495 Moderate: Nginx HTTP Issue
An update for the nginx:1.16 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: nginx:1.16 security update Advisory ID: RHSA-2020:5495-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2020:5495 Issue date: 2020-12-15 CVE Names: CVE-2019-20372 ==================================================================== 1. Summary: An update for the nginx:1.16 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64 3. Description: nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: HTTP request smuggling in configurations with URL redirect used as error_page (CVE-2019-20372) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1790277 - CVE-2019-20372 nginx: HTTP request smuggling in configurations with URL redirect used as error_page 6. Package List: RedHat Enterprise Linux AppStream (v.8): Source: nginx-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.src.rpm aarch64: nginx-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.aarch64.rpm nginx-debuginfo-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.aarch64.rpm nginx-debugsource-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.aarch64.rpm nginx-mod-http-image-filter-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.aarch64.rpm nginx-mod-http-image-filter-debuginfo-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.aarch64.rpm nginx-mod-http-perl-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.aarch64.rpm nginx-mod-http-perl-debuginfo-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.aarch64.rpm nginx-mod-http-xslt-filter-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.aarch64.rpm nginx-mod-http-xslt-filter-debuginfo-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.aarch64.rpm nginx-mod-mail-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.aarch64.rpm nginx-mod-mail-debuginfo-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.aarch64.rpm nginx-mod-stream-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.aarch64.rpm nginx-mod-stream-debuginfo-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.aarch64.rpm noarch: nginx-all-modules-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.noarch.rpm nginx-filesystem-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.noarch.rpm ppc64le: nginx-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.ppc64le.rpm nginx-debuginfo-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.ppc64le.rpm nginx-debugsource-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.ppc64le.rpm nginx-mod-http-image-filter-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.ppc64le.rpm nginx-mod-http-image-filter-debuginfo-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.ppc64le.rpm nginx-mod-http-perl-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.ppc64le.rpm nginx-mod-http-perl-debuginfo-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.ppc64le.rpm nginx-mod-http-xslt-filter-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.ppc64le.rpm nginx-mod-http-xslt-filter-debuginfo-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.ppc64le.rpm nginx-mod-mail-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.ppc64le.rpm nginx-mod-mail-debuginfo-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.ppc64le.rpm nginx-mod-stream-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.ppc64le.rpm nginx-mod-stream-debuginfo-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.ppc64le.rpm s390x: nginx-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.s390x.rpm nginx-debuginfo-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.s390x.rpm nginx-debugsource-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.s390x.rpm nginx-mod-http-image-filter-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.s390x.rpm nginx-mod-http-image-filter-debuginfo-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.s390x.rpm nginx-mod-http-perl-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.s390x.rpm nginx-mod-http-perl-debuginfo-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.s390x.rpm nginx-mod-http-xslt-filter-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.s390x.rpm nginx-mod-http-xslt-filter-debuginfo-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.s390x.rpm nginx-mod-mail-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.s390x.rpm nginx-mod-mail-debuginfo-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.s390x.rpm nginx-mod-stream-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.s390x.rpm nginx-mod-stream-debuginfo-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.s390x.rpm x86_64: nginx-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.x86_64.rpm nginx-debuginfo-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.x86_64.rpm nginx-debugsource-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.x86_64.rpm nginx-mod-http-image-filter-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.x86_64.rpm nginx-mod-http-image-filter-debuginfo-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.x86_64.rpm nginx-mod-http-perl-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.x86_64.rpm nginx-mod-http-perl-debuginfo-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.x86_64.rpm nginx-mod-http-xslt-filter-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.x86_64.rpm nginx-mod-http-xslt-filter-debuginfo-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.x86_64.rpm nginx-mod-mail-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.x86_64.rpm nginx-mod-mail-debuginfo-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.x86_64.rpm nginx-mod-stream-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.x86_64.rpm nginx-mod-stream-debuginfo-1.16.1-1.module+el8.3.0+8844+e5e7039f.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2019-20372 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBX9jwyNzjgjWX9erEAQisHA//fSLm2xgDqIzQDzAVw+UIaBCtVyOdE/MH CuGjXRTEmkLiAgox+nyWdaHKYQ+N/lO+//znIhrP8LlAqtwIEgqmwPcNIZUtrP/b ES8yKiuK9ZhHNfKNN6TIxgcH7B9yPE7HqeR/zYz4RplKzpYmXe/nFuM5koodD3Mg D4EnrOy/tBH92iaZ3oWV+a0xnSrb+XByiss1kWEcilSFa0ZSWCHYtUBYdH7av4wH HZG80HL5TLpeaJFFQ0O5foe5olVPuHv8Uq0uLLfol3EqjP67hT2qHEU28scSJrm5 lQFWhyQkMGPLHph27LOGKOAMWjGZk4j7kanX7PH2s/Z+3zVOLpyw6DfNDp9hiFq5 AxzS5fGo21CvKPU73bZDxp8CS1aMq5w7tTOyxABC122H+NxH75l6Pz6I6RZeEx5s RQfoPdd+FuRGaqE2C/nFwFV/T4w72pg1ekalnnvei2uSClPy/fx2kYuJUItEO3O/ 4CAr+CEWf2+CtT5gK47ln7Kj/ZN3bG1g3p69Dvo+vl3IWJfnG0L30Qaqc+c6JxMZ woVVWd7p2gAVjUZWFOPLfdR7BLglX2bOuBtou87cFX7SZCp4us3ink3xV3s/wbUg HxyHRbgiqZ0invxLxKx5nJSEM3jKpgsH/GM12Hf+t+owrnl2Hc2WniGiDWbvbtYW q8oZDafc8YI=mvX6 -----END PGP SIGNATURE----- -- RHSA-announce mailing list
Dec 15, 2020 •Important Red Hat 
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!