Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2022.6109
nginx security update
23 November 2022
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: nginx
Publisher: Debian
Operating System: Debian GNU/Linux
Resolution: Patch/Upgrade
CVE Names: CVE-2022-41742 CVE-2022-41741 CVE-2021-3618
Original Bulletin:
https://lists.debian.org/debian-lts-announce/2022/11/msg00031.html
Comment: CVSS (Max): 7.8 CVE-2022-41741 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVSS Source: NVD
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- --------------------------BEGIN INCLUDED TEXT--------------------
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-3203-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Markus Koschany
November 23, 2022 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : nginx
Version : 1.14.2-2+deb10u5
CVE ID : CVE-2021-3618 CVE-2022-41741 CVE-2022-41742
Debian Bug : 991328
It was discovered that parsing errors in the mp4 module of Nginx, a
high-performance web and reverse proxy server, could result in denial
of service, memory disclosure or potentially the execution of arbitrary
code when processing a malformed mp4 file.
This module is only enabled in the nginx-extras binary package.
In addition the following vulnerability has been fixed.
CVE-2021-3618
ALPACA is an application layer protocol content confusion attack,
exploiting TLS servers implementing different protocols but using
compatible certificates, such as multi-domain or wildcard certificates.
A MiTM attacker having access to victim's traffic at the TCP/IP layer can
redirect traffic from one subdomain to another, resulting in a valid TLS
session. This breaks the authentication of TLS and cross-protocol attacks
may be possible where the behavior of one protocol service may compromise
For Debian 10 buster, these problems have been fixed in version
1.14.2-2+deb10u5.
We recommend that you upgrade your nginx packages.
For the detailed security status of nginx please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/nginx
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
- -----BEGIN PGP SIGNATURE-----
iQKTBAABCgB9FiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAmN9XdBfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD
RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQACgkQ2a0UuVE7
UeRx4RAAj8wwalflOfZqNCS2jR0Oz8UVcI7x/U14SzEEp5BzumMoqBG9ECssAwUt
cldci4Yf2EujDCpWLEqGubfragzMXVsYr+2/t3UX474AxG6h+HUPqB2S7n4m7289
GeCy3/0b4xGXvax6uTx/9R3HUZ3K/UGPT9Eb2uAYsHfmZrY9djfQlUyh5eXspua9
XlIQLx0Xj9HIn6oywY1BuYz8ZZpPOWPx/Qwc0hv0ZYGwFatpx/TVqUMKHFFXcZLB
R6WkQ88WJT2w0umnWz4aU/jcw+Fy9DWo78i9z2HnR4cesl3dh6Y655iasyO5eJA8
jAIX2GWJqbxnRZw+ncbqXFusMCzzle7RFzdGkWcmdswOUfekf8mWV74DmlnBzGqi
YVSQtEbMH7GeaGcLsARq8bGg2w79pHLhFT2MvRmvMXvV0n+/zjm5eYGbl3L0TUmM
m1eKu0STxFVMSHzHA76BCOFda7IbIuw1tAsUgRYWR7jeNWZo/Pi10zYTakWHLP4y
URPZbfNGF/kTwJmnvfsL4UTbmxvyuoI08K5jCdfyCZK+Q6EGF0Bx6BkInYhV77Ln
3+WrDc6Y7LEFJ+Fs0Jdn66yrdSnIqMeNBM/PagCtDn8JDcI0glmm9VqS3GJrgMWL
bk/ZFT+zILoI9uXef0nSrGk3jyDJvPUufnYSSYLa+YCXcfpxB3g=
=Kwul
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: https://auscert.org.au/gpg-key/
iQIVAwUBY316NMkNZI30y1K9AQjNmRAAm0aPhkqhtf1NUGMI9n0W7W2zbq98zUw9
2M5h0osHskE6e/xTXmCBT6kLEBoxKd6FIcmAF0u/cmkrXo7TcXfy0bZyfp/ws0fK
KKND9xNgVeG0pF8WahhoDWDmQjfrMclOh1WUuOj1l6rBKwT9i3kMain7HKtGyc52
r7KRI8nLpKUstt+5l3A/wNhpeGvd5YAi7wjGAlorAuJR+fWgcLfwYqGZHaUL/6WH
0mpJ6I+qaMpYN0bzZnDxnP8AOWg0u3e/PQsRahBgdpDIelyDpdELNEy2J92Oxvb6
EwMmocszLqmvShqWgpe/Ojedq/oqBujZLe03YTtZ6XQ2ST9I3PjClYkF9G7G1nzK
j6ECQ4on6eXUUtPD+1N4BCtcR8HN5rUP+zodB00l7tNN7vbE8B8ECuGmZZbxz6ue
jZpvHw/TxUkIx6cmDNHgUxvDlo0mwV1663bAWjY1kr1AaSArkGProVEQayuW752X
Q7rS03EvYs917FluL7opRM2JChDPyM9rGNQbGXtzcduwOLov3jT5XGVDc16Uiy9U
0Fh24YRmnWq2KADuc/S5jgSyC0yS4YjiHkSPRdJ+Nxqdj5uw3y3p3H2LGKoGuBts
1xOqsT9izkDZU2mX7tJI5CLQTPzfPFniyNqDZR/rkXLcFqIQeKUhH2ygqj2E6ieu
gIXxkYR3IYo=
=/Fma
-----END PGP SIGNATURE-----