Summary
Bert JW Regeer and Francisco Oca Gonzalez discovered that nginx incorrectly
handled certain error_page configurations. A remote attacker could possibly
use this issue to perform HTTP request smuggling attacks and access
resources contrary to expectations.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | nginx | 1.10.3-0ubuntu0.16.04.5 |
| Ubuntu · 18.04 LTS 18.04:LTS | nginx | 1.14.0-0ubuntu1.7 |
Vulnerabilities 1
-
Unscored —
NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the abil…
References
-
report
https://ubuntu.com/security/CVE-2019-20372