Skip to content
OpenAdvisories
High ELSA-2020-5862 3 CVEs

Important: olcne nginx security update (Oracle Linux 7)

Published Sep 28, 2020 · Updated Sep 28, 2020

Ecosystem: Oracle Linux

Summary

olcne
[1.0.8-2]
- Added nginx-image resource in module definitions to ensure nginx image upgrading

[1.0.8-1]
- support upgrading nginx
- Adress CVE-2019-9511
- Adress CVE-2018-16845
- Adress CVE-2017-7529
- support upgrading flannel

nginx
[1.17.7-2]
- Changed nginx home dir to /var/lib/nginx for consistency

[1.17.7-1]
- Added Oracle Specific Build Files for nginx
- Adress CVE-2019-9511
- Adress CVE-2018-16845
- Adress CVE-2017-7529

Fixed packages 13

ReleasePackageFixed in
Oracle Linux · 7 nginx 1:1.17.7-2.el7
Oracle Linux · 7 nginx-all-modules 1:1.17.7-2.el7
Oracle Linux · 7 nginx-filesystem 1:1.17.7-2.el7
Oracle Linux · 7 nginx-mod-http-image-filter 1:1.17.7-2.el7
Oracle Linux · 7 nginx-mod-http-perl 1:1.17.7-2.el7
Oracle Linux · 7 nginx-mod-http-xslt-filter 1:1.17.7-2.el7
Oracle Linux · 7 nginx-mod-mail 1:1.17.7-2.el7
Oracle Linux · 7 nginx-mod-stream 1:1.17.7-2.el7
Oracle Linux · 7 olcne-agent 0:1.0.8-2.el7
Oracle Linux · 7 olcne-api-server 0:1.0.8-2.el7
Oracle Linux · 7 olcne-nginx 0:1.0.8-2.el7
Oracle Linux · 7 olcne-utils 0:1.0.8-2.el7
Oracle Linux · 7 olcnectl 0:1.0.8-2.el7

Vulnerabilities 3

  • High 8.2
    CVE-2018-16845

    nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_module, which might allow an attacker to c…

    [UNKNOWN] nginx nginx nginx Debian Ubuntu Alpine
  • High 7.5
    CVE-2019-9511 Public exploit EPSS 60%

    Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service

    Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manip…

    nodejs nodejs nodejs nginx Debian Ubuntu Alpine
  • Unscored —
    CVE-2017-7529 Public exploit EPSS 63%

    Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range f…

    nginx nginx nginx nginx Debian Ubuntu Alpine