| Summary: | nginx new security issue CVE-2021-23017 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | critical | ||
| Priority: | Normal | CC: | andrewsfarm, brtians1, ouaurelien, sysadmin-bugs |
| Version: | 8 | Keywords: | advisory, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA7TOO MGA7-64-OK MGA8-64-OK | ||
| Source RPM: | nginx-1.18.0-5.mga8.src.rpm | CVE: | CVE-2021-23017 |
| Status comment: | |||
|
Description
David Walser
2021-05-25 21:30:22 CEST
David Walser
2021-05-25 21:30:34 CEST
Whiteboard:
(none) =>
MGA7TOO Ubuntu has issued an advisory for this on May 26: https://ubuntu.com/security/notices/USN-4967-1 openSUSE has issued an advisory for this on June 4: https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MGLK2LDX6LXOTDRBNVVWP2BFD3ISKDXF/ Fedora has issued an advisory for this on June 11: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/7SFVYHC7OXTEO4SMBWXDVK6E5IMEYMEE/ Advisory: ======================== Updated nginx package fixes security vulnerability: A flaw was found in nginx. An off-by-one error while processing DNS responses allows a network attacker to write a dot character out of bounds in a heap allocated buffer which can allow overwriting the least significant byte of next heap chunk metadata likely leading to a remote code execution in certain circumstances. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability (CVE-2021-23017). References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23017 https://www.openwall.com/lists/oss-security/2021/05/25/5 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/7SFVYHC7OXTEO4SMBWXDVK6E5IMEYMEE/ ======================== Updated packages in core/updates_testing: ======================== nginx-1.16.1-1.3.mga7 nginx-1.18.0-5.1.mga8 from SRPMS: nginx-1.16.1-1.3.mga7.src.rpm nginx-1.18.0-5.1.mga8.src.rpm Status comment:
Patch available from upstream =>
(none) MGA7-64 The following 6 packages are going to be installed: - lib64pcre16_0-8.44-1.mga7.x86_64 - lib64pcre32_0-8.44-1.mga7.x86_64 - lib64pcreposix1-8.44-1.mga7.x86_64 - nginx-1.16.1-1.3.mga7.x86_64 - pcre-8.44-1.mga7.x86_64 - webserver-base-2.0-12.mga7.noarch --- went in and started the service --- first page is working This is the default index.html page that is distributed with nginx on Mageia. It is located in /usr/share/nginx/html. You should now put your content in a location of your choice and edit the root configuration directive in the nginx configuration file /etc/nginx/nginx.conf. CC:
(none) =>
brtians1 MGA8-64 Installed nginx plus certbot, not testing certbot at this time. Jun 28 21:55:44 localhost mageia-drakconf.desktop[3312]: starting installing packages Jun 28 21:55:44 localhost mageia-drakconf.desktop[3312]: created transaction for installing on / (remove=0, install=0, upgrade=51) Jun 28 21:55:47 localhost [RPM][3312]: install python3-zope_interface-5.2.0-2.mga8.x86_64: success Jun 28 21:55:49 localhost [RPM][3312]: install python3-pytz-2020.5-1.mga8.noarch: success Jun 28 21:55:51 localhost [RPM][3312]: install python3-babel-2.9.1-1.mga8.noarch: success Jun 28 21:55:52 localhost [RPM][3312]: install python3-extras-1.0.0-8.mga8.noarch: success Jun 28 21:55:52 localhost [RPM][3312]: install python3-snowballstemmer-1.9.1-2.mga8.noarch: success Jun 28 21:55:54 localhost [RPM][3312]: install python3-pbr-5.5.1-1.mga8.noarch: success Jun 28 21:55:55 localhost [RPM][3312]: install python3-pygments-2.7.4-1.1.mga8.noarch: success Jun 28 21:55:56 localhost [RPM][3312]: install python3-sphinxcontrib-applehelp-1.0.2-1.mga8.noarch: success Jun 28 21:55:57 localhost [RPM][3312]: install python3-sphinxcontrib-qthelp-1.0.3-1.mga8.noarch: success Jun 28 21:55:58 localhost [RPM][3312]: install python3-sphinx-theme-alabaster-0.7.12-3.mga8.noarch: success Jun 28 21:55:59 localhost [RPM][3312]: install python3-sphinxcontrib-htmlhelp-1.0.3-1.mga8.noarch: success Jun 28 21:56:02 localhost [RPM][3312]: install python3-docutils-0.16-1.mga8.noarch: success Jun 28 21:56:03 localhost [RPM][3312]: install python3-sphinxcontrib-jsmath-1.0.1-3.mga8.noarch: success Jun 28 21:56:05 localhost [RPM][3312]: install python3-pyparsing-2.4.7-1.mga8.noarch: success Jun 28 21:56:08 localhost [RPM][3312]: install python3-packaging-20.4-1.mga8.noarch: success Jun 28 21:56:09 localhost [RPM][3312]: install python3-funcsigs-1.0.2-8.mga8.noarch: success Jun 28 21:56:12 localhost [RPM][3312]: install python3-argparse-1.4.0-6.mga8.noarch: success Jun 28 21:56:13 localhost [RPM][3312]: install python3-linecache2-1.0.0-13.mga8.noarch: success Jun 28 21:56:14 localhost [RPM][3312]: install python3-traceback2-1.4.0-12.mga8.noarch: success Jun 28 21:56:15 localhost [RPM][3312]: install python3-unittest2-1.1.0-11.mga8.noarch: success Jun 28 21:56:17 localhost [RPM][3312]: install python-sphinx-locales-3.4.1-2.mga8.noarch: success Jun 28 21:56:17 localhost [RPM][3312]: install python3-imagesize-1.2.0-2.mga8.noarch: success Jun 28 21:56:20 localhost [RPM][3312]: install python3-sphinxcontrib-devhelp-1.0.2-1.mga8.noarch: success Jun 28 21:56:21 localhost [RPM][3312]: install python3-mimeparse-1.6.0-9.mga8.noarch: success Jun 28 21:56:23 localhost [RPM][3312]: install python3-testtools-2.4.0-1.mga8.noarch: success Jun 28 21:56:24 localhost [RPM][3312]: install python3-sphinxcontrib-serializinghtml-1.1.4-1.mga8.noarch: success Jun 28 21:56:31 localhost [RPM][3312]: install glibc-6:2.32-16.mga8.x86_64: success Jun 28 21:56:32 localhost [RPM][3312]: install lib64pcreposix1-8.44-1.mga8.x86_64: success Jun 28 21:56:35 localhost [RPM][3312]: install lib64pcre32_0-8.44-1.mga8.x86_64: success Jun 28 21:56:36 localhost [RPM][3312]: install lib64pcre16_0-8.44-1.mga8.x86_64: success Jun 28 21:56:37 localhost [RPM][3312]: install python3-markupsafe-1.1.1-6.mga8.x86_64: success Jun 28 21:56:39 localhost [RPM][3312]: install python3-jinja2-2.11.3-1.mga8.noarch: success Jun 28 21:56:43 localhost [RPM][3312]: install python3-sphinx_rtd_theme-0.4.3-4.mga8.noarch: success Jun 28 21:56:45 localhost [RPM][3312]: install python3-sphinx-3.4.1-2.mga8.noarch: success Jun 28 21:56:47 localhost [RPM][3312]: install python3-repoze-sphinx-autointerface-0.8-8.mga8.noarch: success Jun 28 21:56:49 localhost [RPM][3312]: install python3-zope-exceptions-4.3-3.mga8.noarch: success Jun 28 21:56:49 localhost [RPM][3312]: install pcre-8.44-1.mga8.x86_64: success Jun 28 21:56:51 localhost [RPM][3312]: install glibc-devel-6:2.32-16.mga8.x86_64: success Jun 28 21:56:52 localhost [RPM][3312]: install python3-subunit-1.3.0-5.mga8.noarch: success Jun 28 21:56:54 localhost [RPM][3312]: install python3-mock-4.0.2-1.mga8.noarch: success Jun 28 21:56:55 localhost [RPM][3312]: install python3-pyrfc3339-1.1-3.mga8.noarch: success Jun 28 21:56:57 localhost [RPM][3312]: install python3-zope.proxy-4.3.5-1.mga8.x86_64: success Jun 28 21:56:59 localhost [RPM][3312]: install python3-zope.hookable-5.0.1-1.mga8.x86_64: success Jun 28 21:57:00 localhost [RPM][3312]: install python3-configobj-5.0.6-6.mga8.noarch: success Jun 28 21:57:02 localhost [RPM][3312]: install python3-requests-toolbelt-0.9.1-3.mga8.noarch: success Jun 28 21:57:03 localhost [RPM][3312]: install python3-configargparse-1.2.3-1.mga8.noarch: success Jun 28 21:57:07 localhost [RPM][3312]: install python3-pyasn1-0.4.8-2.mga8.noarch: success Jun 28 21:57:08 localhost [RPM][3312]: install python3-parsedatetime-2.5-2.mga8.noarch: success Jun 28 21:57:09 localhost [RPM][3312]: install python3-dialog-3.4.0-6.mga8.noarch: success Jun 28 21:57:11 localhost [RPM][3312]: install python3-zope-testing-4.7-3.mga8.noarch: success Jun 28 21:57:12 localhost [RPM][3312]: install python3-ply-3.11-5.mga8.noarch: success Jun 28 21:57:15 localhost [RPM][3312]: install python3-zope_interface-5.2.0-2.mga8.x86_64: success Jun 28 21:57:15 localhost [RPM][3312]: install python3-pytz-2020.5-1.mga8.noarch: success Jun 28 21:57:15 localhost [RPM][3312]: install python3-babel-2.9.1-1.mga8.noarch: success Jun 28 21:57:15 localhost [RPM][3312]: install python3-extras-1.0.0-8.mga8.noarch: success Jun 28 21:57:15 localhost [RPM][3312]: install python3-snowballstemmer-1.9.1-2.mga8.noarch: success Jun 28 21:57:15 localhost [RPM][3312]: install python3-pbr-5.5.1-1.mga8.noarch: success Jun 28 21:57:15 localhost [RPM][3312]: install python3-pygments-2.7.4-1.1.mga8.noarch: success Jun 28 21:57:15 localhost [RPM][3312]: install python3-sphinxcontrib-applehelp-1.0.2-1.mga8.noarch: success Jun 28 21:57:15 localhost [RPM][3312]: install python3-sphinxcontrib-qthelp-1.0.3-1.mga8.noarch: success Jun 28 21:57:15 localhost [RPM][3312]: install python3-sphinx-theme-alabaster-0.7.12-3.mga8.noarch: success Jun 28 21:57:15 localhost [RPM][3312]: install python3-sphinxcontrib-htmlhelp-1.0.3-1.mga8.noarch: success Jun 28 21:57:15 localhost [RPM][3312]: install python3-docutils-0.16-1.mga8.noarch: success Jun 28 21:57:15 localhost [RPM][3312]: install python3-sphinxcontrib-jsmath-1.0.1-3.mga8.noarch: success Jun 28 21:57:15 localhost [RPM][3312]: install python3-pyparsing-2.4.7-1.mga8.noarch: success Jun 28 21:57:15 localhost [RPM][3312]: install python3-packaging-20.4-1.mga8.noarch: success Jun 28 21:57:15 localhost [RPM][3312]: install python3-funcsigs-1.0.2-8.mga8.noarch: success Jun 28 21:57:15 localhost [RPM][3312]: install python3-argparse-1.4.0-6.mga8.noarch: success Jun 28 21:57:15 localhost [RPM][3312]: install python3-linecache2-1.0.0-13.mga8.noarch: success Jun 28 21:57:15 localhost [RPM][3312]: install python3-traceback2-1.4.0-12.mga8.noarch: success Jun 28 21:57:15 localhost [RPM][3312]: install python3-unittest2-1.1.0-11.mga8.noarch: success Jun 28 21:57:15 localhost [RPM][3312]: install python-sphinx-locales-3.4.1-2.mga8.noarch: success Jun 28 21:57:15 localhost [RPM][3312]: install python3-imagesize-1.2.0-2.mga8.noarch: success Jun 28 21:57:15 localhost [RPM][3312]: install python3-sphinxcontrib-devhelp-1.0.2-1.mga8.noarch: success Jun 28 21:57:15 localhost [RPM][3312]: install python3-mimeparse-1.6.0-9.mga8.noarch: success Jun 28 21:57:15 localhost [RPM][3312]: install python3-testtools-2.4.0-1.mga8.noarch: success Jun 28 21:57:15 localhost [RPM][3312]: install python3-sphinxcontrib-serializinghtml-1.1.4-1.mga8.noarch: success Jun 28 21:57:16 localhost [RPM][3312]: install glibc-6:2.32-16.mga8.x86_64: success Jun 28 21:57:16 localhost [RPM][3312]: install lib64pcreposix1-8.44-1.mga8.x86_64: success Jun 28 21:57:16 localhost [RPM][3312]: install lib64pcre32_0-8.44-1.mga8.x86_64: success Jun 28 21:57:16 localhost [RPM][3312]: install lib64pcre16_0-8.44-1.mga8.x86_64: success Jun 28 21:57:16 localhost [RPM][3312]: install python3-markupsafe-1.1.1-6.mga8.x86_64: success Jun 28 21:57:16 localhost [RPM][3312]: install python3-jinja2-2.11.3-1.mga8.noarch: success Jun 28 21:57:16 localhost [RPM][3312]: install python3-sphinx_rtd_theme-0.4.3-4.mga8.noarch: success Jun 28 21:57:16 localhost [RPM][3312]: install python3-sphinx-3.4.1-2.mga8.noarch: success Jun 28 21:57:16 localhost [RPM][3312]: install python3-repoze-sphinx-autointerface-0.8-8.mga8.noarch: success Jun 28 21:57:16 localhost [RPM][3312]: install python3-zope-exceptions-4.3-3.mga8.noarch: success Jun 28 21:57:16 localhost [RPM][3312]: install pcre-8.44-1.mga8.x86_64: success Jun 28 21:57:16 localhost [RPM][3312]: install glibc-devel-6:2.32-16.mga8.x86_64: success Jun 28 21:57:16 localhost [RPM][3312]: install python3-subunit-1.3.0-5.mga8.noarch: success Jun 28 21:57:16 localhost [RPM][3312]: install python3-mock-4.0.2-1.mga8.noarch: success Jun 28 21:57:16 localhost [RPM][3312]: install python3-pyrfc3339-1.1-3.mga8.noarch: success Jun 28 21:57:16 localhost [RPM][3312]: install python3-zope.proxy-4.3.5-1.mga8.x86_64: success Jun 28 21:57:16 localhost [RPM][3312]: install python3-zope.hookable-5.0.1-1.mga8.x86_64: success Jun 28 21:57:16 localhost [RPM][3312]: install python3-configobj-5.0.6-6.mga8.noarch: success Jun 28 21:57:16 localhost [RPM][3312]: install python3-requests-toolbelt-0.9.1-3.mga8.noarch: success Jun 28 21:57:16 localhost [RPM][3312]: install python3-configargparse-1.2.3-1.mga8.noarch: success Jun 28 21:57:16 localhost [RPM][3312]: install python3-pyasn1-0.4.8-2.mga8.noarch: success Jun 28 21:57:16 localhost [RPM][3312]: install python3-parsedatetime-2.5-2.mga8.noarch: success Jun 28 21:57:16 localhost [RPM][3312]: install python3-dialog-3.4.0-6.mga8.noarch: success Jun 28 21:57:16 localhost [RPM][3312]: install python3-zope-testing-4.7-3.mga8.noarch: success Jun 28 21:57:16 localhost [RPM][3312]: install python3-ply-3.11-5.mga8.noarch: success Jun 28 21:57:26 localhost drakrpm[3312]: transaction on / (remove=0, install=0, upgrade=27) Jun 28 21:57:34 localhost [RPM][3312]: install python3-zope-event-4.5.0-1.mga8.noarch: success Jun 28 21:57:36 localhost [RPM][3312]: install python3-future-0.17.1-5.mga8.noarch: success Jun 28 21:57:40 localhost [RPM][3312]: install webserver-base-2.0-15.mga8.noarch: success Jun 28 21:57:43 localhost [RPM][3312]: install nginx-1.18.0-5.1.mga8.x86_64: success Jun 28 21:57:48 localhost [RPM][3312]: install php-openssl-3:8.0.7-1.1.mga8.x86_64: success Jun 28 21:57:51 localhost [RPM][3312]: install php-sysvshm-3:8.0.7-1.1.mga8.x86_64: success Jun 28 21:57:53 localhost [RPM][3312]: install php-session-3:8.0.7-1.1.mga8.x86_64: success Jun 28 21:57:55 localhost [RPM][3312]: install php-fpm-3:8.0.7-1.1.mga8.x86_64: success Jun 28 21:57:56 localhost [RPM][3312]: install php-sysvsem-3:8.0.7-1.1.mga8.x86_64: success Jun 28 21:57:57 localhost [RPM][3312]: install php-ini-3:8.0.7-1.1.mga8.x86_64: success Jun 28 21:57:57 localhost [RPM][3312]: install php-zlib-3:8.0.7-1.1.mga8.x86_64: success Jun 28 21:57:58 localhost [RPM][3312]: install python3-psutil-5.7.3-1.mga8.x86_64: success Jun 28 21:57:59 localhost [RPM][3312]: install python3-zope-testrunner-5.2-1.mga8.noarch: success Jun 28 21:58:02 localhost [RPM][3312]: install python3-zope-deferredimport-4.3.1-4.mga8.noarch: success Jun 28 21:58:03 localhost [RPM][3312]: install python3-pycparser-2.20-1.mga8.noarch: success Jun 28 21:58:05 localhost [RPM][3312]: install python3-cffi-1.14.4-1.mga8.x86_64: success Jun 28 21:58:09 localhost [RPM][3312]: install python3-cryptography-3.3.1-1.1.mga8.x86_64: success Jun 28 21:58:11 localhost [RPM][3312]: install python3-OpenSSL-20.0.0-1.mga8.noarch: success Jun 28 21:58:14 localhost [RPM][3312]: install python3-josepy-1.5.0-1.mga8.noarch: success Jun 28 21:58:17 localhost [RPM][3312]: install python3-ndg_httpsclient-0.5.1-6.mga8.noarch: success Jun 28 21:58:18 localhost [RPM][3312]: install python3-requests+security-2.25.1-1.mga8.noarch: success Jun 28 21:58:19 localhost [RPM][3312]: install python3-acme-1.10.1-1.mga8.noarch: success Jun 28 21:58:19 localhost [RPM][3312]: install python3-zope.deprecation-4.4.0-4.mga8.noarch: success Jun 28 21:58:21 localhost [RPM][3312]: install python3-zope-component-4.6.2-1.mga8.noarch: success Jun 28 21:58:22 localhost [RPM][3312]: install certbot-1.10.1-1.mga8.noarch: success Jun 28 21:58:22 localhost [RPM][3312]: install certbot-nginx-1.10.1-1.mga8.noarch: success Jun 28 21:58:23 localhost [RPM][3312]: install php-fpm-nginx-3:8.0.7-1.1.mga8.x86_64: success Jun 28 21:58:24 localhost [RPM][3312]: install python3-zope-event-4.5.0-1.mga8.noarch: success Jun 28 21:58:24 localhost [RPM][3312]: install python3-future-0.17.1-5.mga8.noarch: success Jun 28 21:58:24 localhost [RPM][3312]: install webserver-base-2.0-15.mga8.noarch: success Jun 28 21:58:24 localhost [RPM][3312]: install nginx-1.18.0-5.1.mga8.x86_64: success Jun 28 21:58:24 localhost [RPM][3312]: install php-openssl-3:8.0.7-1.1.mga8.x86_64: success Jun 28 21:58:24 localhost [RPM][3312]: install php-sysvshm-3:8.0.7-1.1.mga8.x86_64: success Jun 28 21:58:24 localhost [RPM][3312]: install php-session-3:8.0.7-1.1.mga8.x86_64: success Jun 28 21:58:24 localhost [RPM][3312]: install php-fpm-3:8.0.7-1.1.mga8.x86_64: success Jun 28 21:58:24 localhost [RPM][3312]: install php-sysvsem-3:8.0.7-1.1.mga8.x86_64: success Jun 28 21:58:24 localhost [RPM][3312]: install php-ini-3:8.0.7-1.1.mga8.x86_64: success Jun 28 21:58:24 localhost [RPM][3312]: install php-zlib-3:8.0.7-1.1.mga8.x86_64: success Jun 28 21:58:24 localhost [RPM][3312]: install python3-psutil-5.7.3-1.mga8.x86_64: success Jun 28 21:58:24 localhost [RPM][3312]: install python3-zope-testrunner-5.2-1.mga8.noarch: success Jun 28 21:58:24 localhost [RPM][3312]: install python3-zope-deferredimport-4.3.1-4.mga8.noarch: success Jun 28 21:58:24 localhost [RPM][3312]: install python3-pycparser-2.20-1.mga8.noarch: success Jun 28 21:58:24 localhost [RPM][3312]: install python3-cffi-1.14.4-1.mga8.x86_64: success Jun 28 21:58:24 localhost [RPM][3312]: install python3-cryptography-3.3.1-1.1.mga8.x86_64: success Jun 28 21:58:24 localhost [RPM][3312]: install python3-OpenSSL-20.0.0-1.mga8.noarch: success Jun 28 21:58:24 localhost [RPM][3312]: install python3-josepy-1.5.0-1.mga8.noarch: success Jun 28 21:58:24 localhost [RPM][3312]: install python3-ndg_httpsclient-0.5.1-6.mga8.noarch: success Jun 28 21:58:24 localhost [RPM][3312]: install python3-requests+security-2.25.1-1.mga8.noarch: success Jun 28 21:58:24 localhost [RPM][3312]: install python3-acme-1.10.1-1.mga8.noarch: success Jun 28 21:58:24 localhost [RPM][3312]: install python3-zope.deprecation-4.4.0-4.mga8.noarch: success Jun 28 21:58:24 localhost [RPM][3312]: install python3-zope-component-4.6.2-1.mga8.noarch: success Jun 28 21:58:24 localhost [RPM][3312]: install certbot-1.10.1-1.mga8.noarch: success Jun 28 21:58:24 localhost [RPM][3312]: install certbot-nginx-1.10.1-1.mga8.noarch: success Jun 28 21:58:24 localhost [RPM][3312]: install php-fpm-nginx-3:8.0.7-1.1.mga8.x86_64: success ---changed nginx to start on boot and rebooted box working Welcome to nginx 1.18.0 on Mageia!
Brian Rockwell
2021-06-29 05:10:00 CEST
Whiteboard:
MGA7TOO MGA7-64-OK =>
MGA7TOO MGA7-64-OK MGA8-64-OK Seems like a lot of activity going on in that mga8 update, but I see some of those packages, like glibc, were probably waiting as updates not part of this bug. Just as a piece of advice, I always check for any pending already-pushed updates before installing those under test - I think it avoids confusion. Validating. Advisory in Comment 4. CC:
(none) =>
andrewsfarm
Thomas Andrews
2021-06-29 14:19:09 CEST
CC:
(none) =>
sysadmin-bugs
Aurelien Oudelet
2021-06-29 15:45:22 CEST
CC:
(none) =>
ouaurelien An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2021-0301.html Status:
NEW =>
RESOLVED |