Your message dated Sat, 01 Aug 2020 12:51:28 +0100
with message-id
<43535efb498a168cf81452ca0c326f004f46adc6.ca...@adam-barratt.org.uk>
and subject line Closing bugs for fixes included in 10.5 point release
has caused the Debian Bug report #948652,
regarding buster-pu: package nginx/1.14.2-2+deb10u2
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
948652: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=948652
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: buster
User: [email protected]
Usertags: pu
Hello,
I'd like to upload nginx 1.14.2-2+deb10u2, addressing the non-critical
CVE-2019-20372.
Attaching a debdiff.
[0] https://security-tracker.debian.org/tracker/CVE-2019-20372
[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=948579
-- System Information:
Debian Release: 10.2
APT prefers unstable-debug
APT policy: (500, 'unstable-debug'), (500, 'testing-debug'), (500, 'stable'),
(4, 'unstable'), (2, 'testing'), (1, 'experimental-debug'), (1, 'experimental')
Architecture: amd64 (x86_64)
Kernel: Linux 4.19.0-6-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8),
LANGUAGE=en_US:en (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
diff -Nru nginx-1.14.2/debian/changelog nginx-1.14.2/debian/changelog
--- nginx-1.14.2/debian/changelog 2019-08-13 21:10:28.000000000 +0300
+++ nginx-1.14.2/debian/changelog 2020-01-11 09:28:05.000000000 +0200
@@ -1,3 +1,10 @@
+nginx (1.14.2-2+deb10u2) buster; urgency=medium
+
+ * Handle CVE-2019-20372, error page request smuggling
+ (Closes: #948579)
+
+ -- Christos Trochalakis <[email protected]> Sat, 11 Jan 2020 09:28:05
+0200
+
nginx (1.14.2-2+deb10u1) buster-security; urgency=high
* Backport upstream fixes for 3 CVEs (Closes: #935037)
diff -Nru nginx-1.14.2/debian/patches/CVE-2019-20372.patch
nginx-1.14.2/debian/patches/CVE-2019-20372.patch
--- nginx-1.14.2/debian/patches/CVE-2019-20372.patch 1970-01-01
02:00:00.000000000 +0200
+++ nginx-1.14.2/debian/patches/CVE-2019-20372.patch 2020-01-11
09:28:05.000000000 +0200
@@ -0,0 +1,31 @@
+From 8bffc01d084b4881e3eed2052c115b8f04268cb9 Mon Sep 17 00:00:00 2001
+From: Ruslan Ermilov <[email protected]>
+Date: Mon, 23 Dec 2019 15:45:46 +0300
+Subject: [PATCH] Discard request body when redirecting to a URL via
+ error_page.
+
+Reported by Bert JW Regeer and Francisco Oca Gonzalez.
+---
+ src/http/ngx_http_special_response.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/src/http/ngx_http_special_response.c
b/src/http/ngx_http_special_response.c
+index 2c1ff174..e2a5e9dc 100644
+--- a/src/http/ngx_http_special_response.c
++++ b/src/http/ngx_http_special_response.c
+@@ -623,6 +623,12 @@ ngx_http_send_error_page(ngx_http_request_t *r,
ngx_http_err_page_t *err_page)
+ return ngx_http_named_location(r, &uri);
+ }
+
++ r->expect_tested = 1;
++
++ if (ngx_http_discard_request_body(r) != NGX_OK) {
++ r->keepalive = 0;
++ }
++
+ location = ngx_list_push(&r->headers_out.headers);
+
+ if (location == NULL) {
+--
+2.23.0
+
diff -Nru nginx-1.14.2/debian/patches/series nginx-1.14.2/debian/patches/series
--- nginx-1.14.2/debian/patches/series 2019-08-13 21:10:28.000000000 +0300
+++ nginx-1.14.2/debian/patches/series 2020-01-11 09:28:05.000000000 +0200
@@ -3,3 +3,4 @@
CVE-2019-9516.patch
CVE-2019-9511.patch
CVE-2019-9513.patch
+CVE-2019-20372.patch
signature.asc
Description: PGP signature
--- End Message ---
--- Begin Message ---
Package: release.debian.org
Version: 10.5
Hi,
Each of these bugs relates to an update that was included in today's
stable point release.
Regards,
Adam
--- End Message ---
