Summary
It was discovered that nginx Lua module mishandled certain inputs.
An attacker could possibly use this issue to perform an HTTP Request
Smuggling attack. This issue was fixed for Ubuntu 18.04 LTS and
Ubuntu 20.04 LTS. (CVE-2020-11724)
It was discovered that nginx Lua module mishandled certain inputs.
An attacker could possibly use this issue to disclose sensitive
information. This issue only affects Ubuntu 18.04 LTS and
Ubuntu 20.04 LTS. (CVE-2020-36309)
It was discovered that nginx mishandled the use of
compatible certificates among multiple encryption protocols.
If a remote attacker were able to intercept the communication,
this issue could be used to redirect traffic between subdomains.
(CVE-2021-3618)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | nginx | 1.14.0-0ubuntu1.10 |
| Ubuntu · 20.04 LTS 20.04:LTS | nginx | 1.18.0-0ubuntu1.3 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | nginx | 1.10.3-0ubuntu0.16.04.5+esm3 |
Vulnerabilities 3
-
Unscored —
An issue was discovered in OpenResty before 1.15.8.4. ngx_http_lua_subrequest.c allows HTTP request smuggling, as demon…
-
Unscored —
ngx_http_lua_module (aka lua-nginx-module) before 0.10.16 in OpenResty allows unsafe characters in an argument when usi…
-
Unscored —
ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protoco…