Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -1 articles for you...
89
security advisoryfedoraupdateFedora 42 nginx-mod-naxsi Critical Update for CVE-2026-42926 and Others
nginx-mod-vts: Rebuild for 1.30.1 nginx-mod-fancyindex: Rebuild for 1.30.1 nginx-mod-naxsi:. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-38623b4fed 2026-05-15 22:44:59.632855+00:00 -------------------------------------------------------------------------------- Name : nginx-mod-naxsi Product : Fedora 42 Version : 1.6 Release : 17.fc42 URL : https://github.com/wargio/naxsi Summary : nginx web application firewall module Description : naxsi is an nginx module that provides score based Web Application Firewall (WAF) abilities in a highly granular fashion. -------------------------------------------------------------------------------- Update Information: nginx-mod-vts: Rebuild for 1.30.1 nginx-mod-fancyindex: Rebuild for 1.30.1 nginx-mod-naxsi: Rebuild for 1.30.1 nginx-mod-headers-more: Rebuild for 1.30.1 nginx-mod-brotli: Rebuild for 1.30.1 nginx-mod-modsecurity: Rebuild for 1.30.1 nginx: update to 1.30.1 fixes CVE-2026-42926, CVE-2026-42945, CVE-2026-42946, CVE-2026-42934, CVE-2026-40460 and CVE-2026-40701 -------------------------------------------------------------------------------- ChangeLog: * Wed May 13 2026 Felix Kaechele - 1.6-17 - Rebuild for 1.30.1 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2477413 - CVE-2026-42945 nginx: NGINX: Arbitrary Code Execution Vulnerability [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2477413 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-38623b4fed' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPGkeys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
May 15, 2026
•Critical
Fedora
89
security advisoryfedoraarbitrary code executionFedora 43 nginx-mod-naxsi 1.30.1 Critical Updates CVE-2026-42926 & Others
nginx-mod-brotli: Rebuild for 1.30.1 nginx-mod-vts: Rebuild for 1.30.1 nginx-mod-modsecurity:. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-fb53cb4d67 2026-05-15 21:09:28.748523+00:00 -------------------------------------------------------------------------------- Name : nginx-mod-naxsi Product : Fedora 43 Version : 1.6 Release : 17.fc43 URL : https://github.com/wargio/naxsi Summary : nginx web application firewall module Description : naxsi is an nginx module that provides score based Web Application Firewall (WAF) abilities in a highly granular fashion. -------------------------------------------------------------------------------- Update Information: nginx-mod-brotli: Rebuild for 1.30.1 nginx-mod-vts: Rebuild for 1.30.1 nginx-mod-modsecurity: Rebuild for 1.30.1 nginx-mod-fancyindex: Rebuild for 1.30.1 nginx-mod-headers-more: Rebuild for 1.30.1 nginx-mod-naxsi: Rebuild for 1.30.1 nginx: update to 1.30.1 fixes CVE-2026-42926, CVE-2026-42945, CVE-2026-42946, CVE-2026-42934, CVE-2026-40460 and CVE-2026-40701 -------------------------------------------------------------------------------- ChangeLog: * Wed May 13 2026 Felix Kaechele - 1.6-17 - Rebuild for 1.30.1 -------------------------------------------------------------------------------- References: [ 1 ] Bug #2477413 - CVE-2026-42945 nginx: NGINX: Arbitrary Code Execution Vulnerability [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2477413 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-fb53cb4d67' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details onthe GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
May 15, 2026
•Critical
Fedora
197
security advisorymoderatedebianDebian 11 modsecurity-crs Moderate Content-Type Attack Bypass DLA-4488-1
Multiple issues have been fixed in modsecurity-crs, a set of generic attack detection rules for use with ModSecurity. CVE-2023-38199 Coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 does not detect multiple Content-Type request headers on some platforms. This. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4488-1
Feb 22, 2026
•Important
Debian LTS
89
security advisoryfedoracriticalFedora 41: FEDORA-2025-66ebd291f8 Critical: nginx TLS Session Bypass
Changes with nginx 1.26.3 05 Feb 2025 *) Security: insufficient check in virtual servers handling with TLSv1.3 SNI allowed to reuse SSL sessions in a different virtual server, to bypass client SSL certificates verification (CVE-2025-23419). *) Bugfix: in the ngx_http_mp4_module.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-66ebd291f8 2025-02-15 02:35:33.711202+00:00 -------------------------------------------------------------------------------- Name : nginx-mod-naxsi Product : Fedora 41 Version : 1.6 Release : 9.fc41 URL : https://github.com/wargio/naxsi Summary : nginx web application firewall module Description : naxsi is an nginx module that provides score based Web Application Firewall (WAF) abilities in a highly granular fashion. -------------------------------------------------------------------------------- Update Information: Changes with nginx 1.26.3 05 Feb 2025 *) Security: insufficient check in virtual servers handling with TLSv1.3 SNI allowed to reuse SSL sessions in a different virtual server, to bypass client SSL certificates verification (CVE-2025-23419). *) Bugfix: in the ngx_http_mp4_module. Thanks to Nils Bars. *) Workaround: "gzip filter failed to use preallocated memory" alerts appeared in logs when using zlib-ng. *) Bugfix: nginx could not build libatomic library using the library sources if the --with-libatomic=DIR option was used. *) Bugfix: nginx now ignores QUIC version negotiation packets from clients. *) Bugfix: nginx could not be built on Solaris 10 and earlier with the ngx_http_v3_module. *) Bugfixes in HTTP/3. -------------------------------------------------------------------------------- ChangeLog: * Thu Feb 6 2025 Felix Kaechele - 1.6-9 - Rebuild for nginx 1.26.3 * Fri Jan 17 2025 Fedora Release Engineering - 1.6-8 - Rebuilt forhttps://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild * Mon Aug 26 2024 Felix Kaechele - 1.6-7 - Rebuild for nginx 1.26.2... again. -------------------------------------------------------------------------------- References: [ 1 ] Bug #2277663 - please switch to using systemd-sysusers to create the nginx user https://bugzilla.redhat.com/show_bug.cgi?id=2277663 [ 2 ] Bug #2344198 - CVE-2025-23419 nginx: TLS Session Resumption Vulnerability [fedora-41] https://bugzilla.redhat.com/show_bug.cgi?id=2344198 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-66ebd291f8' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Feb 15, 2025
•Critical
Fedora
89
security advisoryupdatecriticalFedora 40: 2025-016ed44ddc critical: nginx TLS session bypass
Changes with nginx 1.26.3 05 Feb 2025 *) Security: insufficient check in virtual servers handling with TLSv1.3 SNI allowed to reuse SSL sessions in a different virtual server, to bypass client SSL certificates verification (CVE-2025-23419). *) Bugfix: in the ngx_http_mp4_module.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-016ed44ddc 2025-02-15 02:22:06.812098+00:00 -------------------------------------------------------------------------------- Name : nginx-mod-naxsi Product : Fedora 40 Version : 1.6 Release : 9.fc40 URL : https://github.com/wargio/naxsi Summary : nginx web application firewall module Description : naxsi is an nginx module that provides score based Web Application Firewall (WAF) abilities in a highly granular fashion. -------------------------------------------------------------------------------- Update Information: Changes with nginx 1.26.3 05 Feb 2025 *) Security: insufficient check in virtual servers handling with TLSv1.3 SNI allowed to reuse SSL sessions in a different virtual server, to bypass client SSL certificates verification (CVE-2025-23419). *) Bugfix: in the ngx_http_mp4_module. Thanks to Nils Bars. *) Workaround: "gzip filter failed to use preallocated memory" alerts appeared in logs when using zlib-ng. *) Bugfix: nginx could not build libatomic library using the library sources if the --with-libatomic=DIR option was used. *) Bugfix: nginx now ignores QUIC version negotiation packets from clients. *) Bugfix: nginx could not be built on Solaris 10 and earlier with the ngx_http_v3_module. *) Bugfixes in HTTP/3. -------------------------------------------------------------------------------- ChangeLog: * Thu Feb 6 2025 Felix Kaechele - 1.6-9 - Rebuild for nginx 1.26.3 * Fri Jan 17 2025 Fedora Release Engineering - 1.6-8 - Rebuilt forhttps://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild * Mon Aug 26 2024 Felix Kaechele - 1.6-7 - Rebuild for nginx 1.26.2... again. -------------------------------------------------------------------------------- References: [ 1 ] Bug #2277663 - please switch to using systemd-sysusers to create the nginx user https://bugzilla.redhat.com/show_bug.cgi?id=2277663 [ 2 ] Bug #2344197 - CVE-2025-23419 nginx: TLS Session Resumption Vulnerability [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2344197 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-016ed44ddc' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list --
Feb 15, 2025
•Critical
Fedora
91
security advisorygentoolow severityGentoo: GLSA 202305-25 Low Severity: OWASP ModSecurity Issues
Multiple vulnerabilities have been discovered in ModSecurity Core Rule Set, the worst of which could result in bypassing the WAF.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202305-25 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Low Title: OWASP ModSecurity Core Rule Set: Multiple Vulnerabilities Date: May 21, 2023 Bugs: #822003, #872077 ID: 202305-25 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities have been discovered in ModSecurity Core Rule Set, the worst of which could result in bypassing the WAF. Background ========= Modsecurity Core Rule Set is the OWASP ModSecurity Core Rule Set. Affected packages ================ Package Vulnerable Unaffected -------------------------- ------------ ------------ www-apache/modsecurity-crs < 3.3.4 > = 3.3.4 Description ========== Multiple vulnerabilities have been discovered in OWASP ModSecurity Core Rule Set. Please review the CVE identifiers referenced below for details. Impact ===== Please review the referenced CVE identifiers for details. Workaround ========= There is no known workaround at this time. Resolution ========= All OWASP ModSecurity Core Rule Set users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =www-apache/modsecurity-crs-3.3.4" References ========= [ 1 ] CVE-2021-35368 https://nvd.nist.gov/vuln/detail/CVE-2021-35368 [ 2 ] CVE-2022-39955 https://nvd.nist.gov/vuln/detail/CVE-2022-39955 [ 3 ] CVE-2022-39956 https://nvd.nist.gov/vuln/detail/CVE-2022-39956 [ 4 ] CVE-2022-39957 https://nvd.nist.gov/vuln/detail/CVE-2022-39957 [ 5 ] CVE-2022-39958 https://nvd.nist.gov/vuln/detail/CVE-2022-39958 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/202305-25 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
May 21, 2023
•Low
Gentoo
197
security advisorydebianapacheDebian 10: DLA-3283-1 Moderate: Modsecurity-Apache Security Fix
Multiple issues were found in modsecurity-apache, open source, cross platform web application firewall (WAF) engine for Apache which allows remote attackers to bypass the applications firewall and other unspecified impact. . ------------------------------------------------------------------------- Debian LTS Advisory DLA-3283-1
Jan 26, 2023
Debian LTS
89
security advisoryfedoracriticalFedora Core 6 Critical: FEDORA-2007-514 Tomcat Cache Poisoning
Several security issues were reported to be fixed in releases prior to tomcat5.5.23 Tomcat was found to accept multiple content-length headers in a request. This could allow attackers to poison a web-cache, bypass web application firewall protection, or conduct cross-site scripting attacks. . ---------------------------------------------------------------------Fedora Update Notification FEDORA-2007-514 2007-05-21 ---------------------------------------------------------------------Product : Fedora Core 6 Name : jakarta-commons-modeler Version : 1.1 Release : 8jpp.2.fc6 Summary : Jakarta Commons Modeler Package Description : The Modeler project shall create and maintain a set of Java classes to provide the facilities described in the preceeding section, plus unit tests and small examples of using these facilities to instrument Java classes with Model MBean support. ---------------------------------------------------------------------Update Information: Several security issues were reported to be fixed in releases prior to 5.5.23 (https://tomcat.apache.org/security-5.html) Tomcat was found to accept multiple content-length headers in a request. This could allow attackers to poison a web-cache, bypass web application firewall protection, or conduct cross-site scripting attacks. (CVE-2005-2090) Tomcat permitted various characters as path delimiters. If Tomcat was used behind certain proxies and configured to only proxy some contexts, an attacker could construct an HTTP request to work around the context restriction and potentially access non-proxied content. (CVE-2007-0450) The implict-objects.jsp file distributed in the examples webapp displayed a number of unfiltered header values. If the JSP examples were accessible, this flaw could allow a remote attacker to perform cross-site scripting attacks. (CVE-2006-7195) Users should upgrade to these erratum packages which contain an update to Tomcat that resolves these issues.Updated jakarta-commons-modeler packages are also included which correct a bug when used with Tomcat 5.5.23. ---------------------------------------------------------------------* Sun Apr 29 2007 Vivek Lakshmanan - 0:1.1-8jpp.2 - Add patch to fix jira task: MODELER-15 to allow tomcat5 5.5.23 to build against j-c-modeler - Resolves: bug 237704 ---------------------------------------------------------------------This update can be downloaded from: dad1218b669850e79dbd5d467c95ed95301b8d34 SRPMS/jakarta-commons-modeler-1.1-8jpp.2.fc6.src.rpm dad1218b669850e79dbd5d467c95ed95301b8d34 noarch/jakarta-commons-modeler-1.1-8jpp.2.fc6.src.rpm 8dd80a01e127b5d40d732ce2e75c5c04e2000421 ppc/jakarta-commons-modeler-javadoc-1.1-8jpp.2.fc6.ppc.rpm dd1ab4ed4a18518210a3609441d3c337a2dd5a69 ppc/debug/jakarta-commons-modeler-debuginfo-1.1-8jpp.2.fc6.ppc.rpm 7f4b54c6922fb76248bafd205e14119183ea99df ppc/jakarta-commons-modeler-1.1-8jpp.2.fc6.ppc.rpm 2a629ca2249b3012627ce9cea4ef89eee957f82a x86_64/jakarta-commons-modeler-javadoc-1.1-8jpp.2.fc6.x86_64.rpm c397048d0562227811fb735b49acb0bda2c68511 x86_64/debug/jakarta-commons-modeler-debuginfo-1.1-8jpp.2.fc6.x86_64.rpm 2aa455ba7eb7d52799a3c0d93dab468cefa96c9e x86_64/jakarta-commons-modeler-1.1-8jpp.2.fc6.x86_64.rpm ba5a53f53d214e199394ea50cdf2306b049e9085 i386/debug/jakarta-commons-modeler-debuginfo-1.1-8jpp.2.fc6.i386.rpm 501ec172627d91dbcabb7134d3b5b3c10f256e06 i386/jakarta-commons-modeler-javadoc-1.1-8jpp.2.fc6.i386.rpm faee0b25204c51e08dd19930cf2c81880ce9bc23 i386/jakarta-commons-modeler-1.1-8jpp.2.fc6.i386.rpm This update can be installed with the 'yum' update program. Use 'yum update package-name' at the command line. For more information, refer to 'Managing Software with yum,' available at . ---------------------------------------------------------------------_______________________________________________ Fedora-package-announce mailinglist
May 21, 2007
•Critical
Fedora
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!