| Summary: | nginx new security issues CVE-2018-1684[3-5] | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | major | ||
| Priority: | Normal | CC: | andrewsfarm, lewyssmith, marja11, mhrambo3501, sysadmin-bugs, tarazed25 |
| Version: | 6 | Keywords: | advisory, has_procedure, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA6-64-OK | ||
| Source RPM: | nginx-1.10.3-1.1.mga6.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2018-11-08 18:21:27 CET
signing to all packagers collectively, since there is no registered maintainer for this package. Assignee:
bugsquad =>
pkg-bugs Patched package uploaded for Mageia 6. Advisory: ======================== Patched nginx package fixes security vulnerabilities: nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption (CVE-2018-16843). nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive CPU usage (CVE-2018-16844). nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_module, which might allow an attacker to cause infinite loop in a worker process, cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted mp4 file (CVE-2018-16845). References: https://usn.ubuntu.com/3812-1/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16843 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16844 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16845 ======================== Updated packages in core/updates_testing: ======================== nginx-1.10.3-1.2.mga6 from nginx-1.10.3-1.2.mga6.src.rpm Testing procedure: https://bugs.mageia.org/show_bug.cgi?id=18595#c4 Keywords:
(none) =>
has_procedure Mageia 6, x86_64 Replaced httpd.service with nginx and checked that the introductory page was presented at localhost. Updated, restarted the service and pointed the browser at localhost. Welcome page came up OK. Normal browsing is working fine, including Youtube. This looks OK for 64-bits. CC:
(none) =>
tarazed25
Len Lawrence
2018-11-16 12:45:57 CET
Whiteboard:
(none) =>
MGA6-64-OK Validating. Advisory in Comment 2. Keywords:
(none) =>
validated_update
Lewis Smith
2018-11-17 20:59:38 CET
CC:
(none) =>
lewyssmith An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2018-0459.html Resolution:
(none) =>
FIXED |