Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2020:1171-1

Опубликовано: 04 мая 2020
Источник: suse-cvrf

Описание

Security update for nginx

This update for nginx fixes the following issues:

nginx was updated to 1.16.1 (jsc#ECO-1401)

  • Added TLS 1.3 support (jsc#SLE-9295, bsc#1150711)
  • Replaced obsolete GeoIP module with MaxMinDB-based GeoIP2 (jsc#SLE-11184, bsc#1156202)
  • Started nginx after network is online (bsc#1155690)
  • CVE-2019-20372: Fixed an HTTP request smuggling with certain error_page configurations which could have allowed unauthorized web page reads (bsc#1160682).

Список пакетов

SUSE Linux Enterprise High Performance Computing 15-ESPOS
nginx-1.16.1-3.12.7
SUSE Linux Enterprise High Performance Computing 15-LTSS
nginx-1.16.1-3.12.7
SUSE Linux Enterprise Server 15-LTSS
nginx-1.16.1-3.12.7
SUSE Linux Enterprise Server for SAP Applications 15
nginx-1.16.1-3.12.7

Ссылки

Описание

NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.

Затронутые продукты
SUSE Linux Enterprise High Performance Computing 15-ESPOS:nginx-1.16.1-3.12.7
SUSE Linux Enterprise High Performance Computing 15-LTSS:nginx-1.16.1-3.12.7
SUSE Linux Enterprise Server 15-LTSS:nginx-1.16.1-3.12.7
SUSE Linux Enterprise Server for SAP Applications 15:nginx-1.16.1-3.12.7
Ссылки