USN-4967-2: nginx vulnerability

27 May 2021

nginx could be made to crash or run programs if it received specially crafted network traffic.

Releases

Packages

  • nginx - small, powerful, scalable web/proxy server

Details

USN-4967-1 fixed a vulnerability in nginx. This update provides
the corresponding update for Ubuntu 14.04 ESM and 16.04 ESM.

Original advisory details:

Luis Merino, Markus Vervier, and Eric Sesterhenn discovered that nginx
incorrectly handled responses to the DNS resolver. A remote attacker could
use this issue to cause nginx to crash, resulting in a denial of service,
or possibly execute arbitrary code.

References

Related notices

  • USN-4967-1: nginx-doc, libnginx-mod-http-dav-ext, nginx-core, libnginx-mod-http-geoip2, nginx, nginx-extras, libnginx-mod-http-geoip, libnginx-mod-http-image-filter, libnginx-mod-http-lua, libnginx-mod-rtmp, libnginx-mod-mail, nginx-full, libnginx-mod-http-uploadprogress, nginx-common, libnginx-mod-http-perl, libnginx-mod-http-subs-filter, nginx-light, libnginx-mod-http-auth-pam, libnginx-mod-http-ndk, libnginx-mod-http-cache-purge, libnginx-mod-stream-geoip, libnginx-mod-http-upstream-fair, libnginx-mod-http-echo, libnginx-mod-http-xslt-filter, libnginx-mod-stream, libnginx-mod-http-headers-more-filter, libnginx-mod-stream-geoip2, libnginx-mod-http-fancyindex, libnginx-mod-nchan