Important: nginx:1.14 security update
Summary
ALSA-2019:2799: Important: nginx:1.14 security update. Affects nginx across 3 version ranges.
< 1:1.14.1-9.module_el8.5.0+34+dc1cfba5.alma
< 1:1.14.1-9.module_el8.3.0+2165+af250afe.alma
< 1:1.14.1-9.module_el8.4.0+2221+af250afe.alma
Fixed in 1:1.14.1-9.module_el8.5.0+34+dc1cfba5.alma, 1:1.14.1-9.module_el8.3.0+2165+af250afe.alma or 1:1.14.1-9.module_el8.4.0+2221+af250afe.alma, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3, and IMAP protocols. It is known for its high concurrency, performance, and low memory usage. The vulnerability affects the nginx package in AlmaLinux 8.
Vulnerability Detail
The vulnerability in nginx allows for denial of service attacks and excessive resource consumption through various methods:
- CVE-2019-9511: An attacker can send a large amount of data request, leading to a denial of service.
- CVE-2019-9513: An attacker can flood the server using PRIORITY frames, resulting in excessive resource consumption.
- CVE-2019-9516: An attacker can send 0-length headers, leading to a denial of service.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update nginx-
< 1:1.14.1-9.module_el8.3.0+2165+af250afe.alma1:1.14.1-9.module_el8.3.0+2165+af250afe.alma -
< 1:1.14.1-9.module_el8.4.0+2221+af250afe.alma1:1.14.1-9.module_el8.4.0+2221+af250afe.alma -
< 1:1.14.1-9.module_el8.5.0+34+dc1cfba5.alma1:1.14.1-9.module_el8.5.0+34+dc1cfba5.alma
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability.
Conclusion
In conclusion, the nginx package in AlmaLinux 8 is vulnerable to denial of service attacks and excessive resource consumption. It is recommended to update the package to the latest version to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for nginx →
FAQ
The vulnerability allows for denial of service attacks and excessive resource consumption, potentially leading to service disruption.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability.
There are no known exploits for this vulnerability at this time.
The CVSS score for this vulnerability is not provided in the available information.
You can find more information about this vulnerability in the CVE pages listed in the References section of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for nginx.
