ESB-2021.1850 – [Debian] nginx: Multiple vulnerabilities

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

===========================================================================
AUSCERT External Security Bulletin Redistribution

ESB-2021.1850
nginx security update
31 May 2021

===========================================================================

AusCERT Security Bulletin Summary
———————————

Product: nginx
Publisher: Debian
Operating System: Debian GNU/Linux
Impact/Access: Execute Arbitrary Code/Commands — Remote/Unauthenticated
Denial of Service — Remote/Unauthenticated
Access Confidential Data — Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2021-23017

Reference: ESB-2021.1840
ESB-2021.1833
ESB-2021.1817
ESB-2021.1802

Original Bulletin:
http://www.debian.org/security/2021/dsa-4921

– ————————–BEGIN INCLUDED TEXT——————–

– —–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA512

– – ————————————————————————-
Debian Security Advisory DSA-4921-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
May 28, 2021 https://www.debian.org/security/faq
– – ————————————————————————-

Package : nginx
CVE ID : CVE-2021-23017
Debian Bug : 989095

Luis Merino, Markus Vervier and Eric Sesterhenn discovered an off-by-one
in Nginx, a high-performance web and reverse proxy server, which could
result in denial of service and potentially the execution of arbitrary
code.

For the stable distribution (buster), this problem has been fixed in
version 1.14.2-2+deb10u4.

We recommend that you upgrade your nginx packages.

For the detailed security status of nginx please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/nginx

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
– —–BEGIN PGP SIGNATURE—–

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmCw3CMACgkQEMKTtsN8
TjYgGA/9FlgRs/kkpLxlnM5ymYDA+WAmc44BiKLajlItjdw54nifSb7WJQifSjND
wWz6/1Qc2R84mgovtdReIcgEQDDmm8iCpslsWt4r/iWT5m/tlZhkLhBN1AyhW8VS
u1Goqt+hFkz0fZMzv1vf9MwRkUma8SjxNcQdjs4fHzyZAfo+QoV4Ir0I7DIMKkZk
N5teHqHIMaDasRZFQSpL8NuZC+JN5EEpB764mV+O/YqVrWeE9QUAnL0FgjcQUnmh
iQ5AmMJRtAnQXXu9Qkpx9WtDemHLFHC9JsWEKE3TJAegA4ZhfOo5MZcjesn6EoqV
8rXAAupWzO5/wTxMeulqz4HTLeYPs+jTSONHwT1oG9kgY59jVcNVjg2DcGbG3/17
ueZdGTy70pgLSL6IKILNBgqHh0AqSyyuZmocy07DNGay+HzwuFSBq4RCCved+EPW
4CMtIPSujjPzQqvg15gFNKt/7T2ZfKFR7zVfm0itI6KTjyAhmFhaNYNwWEifX68u
8akhscDlUxmDQG1kbQ2u/IZqWeKG/TpbqaaTrTl6U+Gl1hmRO06Y4AckW1Xwm2r4
CFSO9uHeNte5Vsw+4NlDntzRZOOfJ6qW8x0XF5Vgn7R9mfYPlvIWJgptsgrrijnf
lhCPw5JMpzQ4afWlRUvQiaf0lOIySKIfv05wHPtIablmgjIGny4=
=qxQw
– —–END PGP SIGNATURE—–

– ————————–END INCLUDED TEXT——————–

You have received this e-mail bulletin as a result of your organisation’s
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT’s members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation’s
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author’s website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
—–BEGIN PGP SIGNATURE—–
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBYLRTuONLKJtyKPYoAQg0yRAArm/WSWL9S0ukOXxS9hfNcb0VNXjqRcSC
x8IB4TVicWJKu2MSfIjT8wNiLxN/MMJh8ZIYzW6gZ9MvP8pUsG4AYj3dyt2DD8+3
pSJUWsxObqV9vwYmuItHLLTmaREXQmz9dNxStIVeahDN7OsIIRAMc1GE6NaHbMEA
rW1jY9ysWtbZcgk49FOWcu7Hoa0OkDio7zcjSesdxW661LAr2ZGXEBnzneIzzxyn
pE0I1n/Zp0cmJsIJR2F1G260GEpMVyArxUXfDcQWSNAWdjyPfUh3JX54NoF76fVS
jWsqiKzmbO6XCBDrb4sEg3OnQlJOwFmliYZ327EgZIZa6lhlzGn8VZFWbx6Jl42r
o6scG4F+ZWcE7WFE+EKn5WFbhiaEPMOeafOiUP3+qKMgYEp7KB8shhM0FNpQMaUu
gs1PFEQEKhP/UukytrCdTh/zEIC/mnV9MoF2xD9jDFf0Xf1kWq61SuIY0U38UkAW
+xap6uwZCz/aS8dPjRMt00JIG6UBjHNrvNpMWM9bLj1rDA83SBSeGXYKD0ILhyxl
RKOy9pAwGCAed/6UdBNIFI9aVQDbOmmhSm9fHbKxyLGkl/czB9o6Nf2CgxzF5hzj
bpvSOoPUC8gv/ZgXC4pUNZdWPUE1eyG5eQHCB6IY0C/eZBf15Hoh5G6Y2H5sB2bZ
LAGlReMJALQ=
=0RSp
—–END PGP SIGNATURE—–

Read More

The post ESB-2021.1850 – [Debian] nginx: Multiple vulnerabilities appeared first on Malware Devil.

https://malwaredevil.com/2021/05/31/esb-2021-1850-debian-nginx-multiple-vulnerabilities/?utm_source=rss&utm_medium=rss&utm_campaign=esb-2021-1850-debian-nginx-multiple-vulnerabilities