Vulmon
Amazon Linux 2 Security Advisory: ALASNGINX1-2023-004
Advisory Release Date: 2023-08-07 06:17 Pacific
Advisory Updated Date: 2023-09-25 22:08 Pacific
Severity:
Medium
Issue Overview:
NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer. (CVE-2019-20372)
Affected Packages:
nginx
Issue Correction:
Run yum update nginx to update your system.
New Packages:
aarch64:
nginx-1.18.0-1.amzn2.0.1.aarch64
nginx-mod-http-geoip-1.18.0-1.amzn2.0.1.aarch64
nginx-mod-http-image-filter-1.18.0-1.amzn2.0.1.aarch64
nginx-mod-http-perl-1.18.0-1.amzn2.0.1.aarch64
nginx-mod-http-xslt-filter-1.18.0-1.amzn2.0.1.aarch64
nginx-mod-mail-1.18.0-1.amzn2.0.1.aarch64
nginx-mod-stream-1.18.0-1.amzn2.0.1.aarch64
nginx-debuginfo-1.18.0-1.amzn2.0.1.aarch64
noarch:
nginx-all-modules-1.18.0-1.amzn2.0.1.noarch
nginx-filesystem-1.18.0-1.amzn2.0.1.noarch
src:
nginx-1.18.0-1.amzn2.0.1.src
x86_64:
nginx-1.18.0-1.amzn2.0.1.x86_64
nginx-mod-http-geoip-1.18.0-1.amzn2.0.1.x86_64
nginx-mod-http-image-filter-1.18.0-1.amzn2.0.1.x86_64
nginx-mod-http-perl-1.18.0-1.amzn2.0.1.x86_64
nginx-mod-http-xslt-filter-1.18.0-1.amzn2.0.1.x86_64
nginx-mod-mail-1.18.0-1.amzn2.0.1.x86_64
nginx-mod-stream-1.18.0-1.amzn2.0.1.x86_64
nginx-debuginfo-1.18.0-1.amzn2.0.1.x86_64