-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: nginx:1.14 security update Advisory ID: RHSA-2019:2799-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2019:2799 Issue date: 2019-09-17 CVE Names: CVE-2019-9511 CVE-2019-9513 CVE-2019-9516 ==================================================================== 1. Summary: An update for the nginx:1.14 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64 3. Description: Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 (Post Office Protocol 3) and IMAP protocols, with a focus on high concurrency, performance and low memory usage. Security Fix(es): * HTTP/2: large amount of data request leads to denial of service (CVE-2019-9511) * HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption (CVE-2019-9513) * HTTP/2: 0-length headers leads to denial of service (CVE-2019-9516) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1735741 - CVE-2019-9513 HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption 1741860 - CVE-2019-9511 HTTP/2: large amount of data requests leads to denial of service 1741864 - CVE-2019-9516 HTTP/2: 0-length headers lead to denial of service 6. Package List: Red Hat Enterprise Linux AppStream (v. 8): Source: nginx-1.14.1-9.module+el8.0.0+4108+af250afe.src.rpm aarch64: nginx-1.14.1-9.module+el8.0.0+4108+af250afe.aarch64.rpm nginx-debuginfo-1.14.1-9.module+el8.0.0+4108+af250afe.aarch64.rpm nginx-debugsource-1.14.1-9.module+el8.0.0+4108+af250afe.aarch64.rpm nginx-mod-http-image-filter-1.14.1-9.module+el8.0.0+4108+af250afe.aarch64.rpm nginx-mod-http-image-filter-debuginfo-1.14.1-9.module+el8.0.0+4108+af250afe.aarch64.rpm nginx-mod-http-perl-1.14.1-9.module+el8.0.0+4108+af250afe.aarch64.rpm nginx-mod-http-perl-debuginfo-1.14.1-9.module+el8.0.0+4108+af250afe.aarch64.rpm nginx-mod-http-xslt-filter-1.14.1-9.module+el8.0.0+4108+af250afe.aarch64.rpm nginx-mod-http-xslt-filter-debuginfo-1.14.1-9.module+el8.0.0+4108+af250afe.aarch64.rpm nginx-mod-mail-1.14.1-9.module+el8.0.0+4108+af250afe.aarch64.rpm nginx-mod-mail-debuginfo-1.14.1-9.module+el8.0.0+4108+af250afe.aarch64.rpm nginx-mod-stream-1.14.1-9.module+el8.0.0+4108+af250afe.aarch64.rpm nginx-mod-stream-debuginfo-1.14.1-9.module+el8.0.0+4108+af250afe.aarch64.rpm noarch: nginx-all-modules-1.14.1-9.module+el8.0.0+4108+af250afe.noarch.rpm nginx-filesystem-1.14.1-9.module+el8.0.0+4108+af250afe.noarch.rpm ppc64le: nginx-1.14.1-9.module+el8.0.0+4108+af250afe.ppc64le.rpm nginx-debuginfo-1.14.1-9.module+el8.0.0+4108+af250afe.ppc64le.rpm nginx-debugsource-1.14.1-9.module+el8.0.0+4108+af250afe.ppc64le.rpm nginx-mod-http-image-filter-1.14.1-9.module+el8.0.0+4108+af250afe.ppc64le.rpm nginx-mod-http-image-filter-debuginfo-1.14.1-9.module+el8.0.0+4108+af250afe.ppc64le.rpm nginx-mod-http-perl-1.14.1-9.module+el8.0.0+4108+af250afe.ppc64le.rpm nginx-mod-http-perl-debuginfo-1.14.1-9.module+el8.0.0+4108+af250afe.ppc64le.rpm nginx-mod-http-xslt-filter-1.14.1-9.module+el8.0.0+4108+af250afe.ppc64le.rpm nginx-mod-http-xslt-filter-debuginfo-1.14.1-9.module+el8.0.0+4108+af250afe.ppc64le.rpm nginx-mod-mail-1.14.1-9.module+el8.0.0+4108+af250afe.ppc64le.rpm nginx-mod-mail-debuginfo-1.14.1-9.module+el8.0.0+4108+af250afe.ppc64le.rpm nginx-mod-stream-1.14.1-9.module+el8.0.0+4108+af250afe.ppc64le.rpm nginx-mod-stream-debuginfo-1.14.1-9.module+el8.0.0+4108+af250afe.ppc64le.rpm s390x: nginx-1.14.1-9.module+el8.0.0+4108+af250afe.s390x.rpm nginx-debuginfo-1.14.1-9.module+el8.0.0+4108+af250afe.s390x.rpm nginx-debugsource-1.14.1-9.module+el8.0.0+4108+af250afe.s390x.rpm nginx-mod-http-image-filter-1.14.1-9.module+el8.0.0+4108+af250afe.s390x.rpm nginx-mod-http-image-filter-debuginfo-1.14.1-9.module+el8.0.0+4108+af250afe.s390x.rpm nginx-mod-http-perl-1.14.1-9.module+el8.0.0+4108+af250afe.s390x.rpm nginx-mod-http-perl-debuginfo-1.14.1-9.module+el8.0.0+4108+af250afe.s390x.rpm nginx-mod-http-xslt-filter-1.14.1-9.module+el8.0.0+4108+af250afe.s390x.rpm nginx-mod-http-xslt-filter-debuginfo-1.14.1-9.module+el8.0.0+4108+af250afe.s390x.rpm nginx-mod-mail-1.14.1-9.module+el8.0.0+4108+af250afe.s390x.rpm nginx-mod-mail-debuginfo-1.14.1-9.module+el8.0.0+4108+af250afe.s390x.rpm nginx-mod-stream-1.14.1-9.module+el8.0.0+4108+af250afe.s390x.rpm nginx-mod-stream-debuginfo-1.14.1-9.module+el8.0.0+4108+af250afe.s390x.rpm x86_64: nginx-1.14.1-9.module+el8.0.0+4108+af250afe.x86_64.rpm nginx-debuginfo-1.14.1-9.module+el8.0.0+4108+af250afe.x86_64.rpm nginx-debugsource-1.14.1-9.module+el8.0.0+4108+af250afe.x86_64.rpm nginx-mod-http-image-filter-1.14.1-9.module+el8.0.0+4108+af250afe.x86_64.rpm nginx-mod-http-image-filter-debuginfo-1.14.1-9.module+el8.0.0+4108+af250afe.x86_64.rpm nginx-mod-http-perl-1.14.1-9.module+el8.0.0+4108+af250afe.x86_64.rpm nginx-mod-http-perl-debuginfo-1.14.1-9.module+el8.0.0+4108+af250afe.x86_64.rpm nginx-mod-http-xslt-filter-1.14.1-9.module+el8.0.0+4108+af250afe.x86_64.rpm nginx-mod-http-xslt-filter-debuginfo-1.14.1-9.module+el8.0.0+4108+af250afe.x86_64.rpm nginx-mod-mail-1.14.1-9.module+el8.0.0+4108+af250afe.x86_64.rpm nginx-mod-mail-debuginfo-1.14.1-9.module+el8.0.0+4108+af250afe.x86_64.rpm nginx-mod-stream-1.14.1-9.module+el8.0.0+4108+af250afe.x86_64.rpm nginx-mod-stream-debuginfo-1.14.1-9.module+el8.0.0+4108+af250afe.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2019-9511 https://access.redhat.com/security/cve/CVE-2019-9513 https://access.redhat.com/security/cve/CVE-2019-9516 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2019 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXYMvM9zjgjWX9erEAQiQBg/9FXF0Th2IskSgruQO/AUHc1Bz9MnFTriv CWUtVTcMmoRfJtXcM32sCs4l1vyTcCKfjShiEWaWMaRpuPppYy04PFnOwkmHtyms SV5mqDITXr9GrUEUuo6AnO0JdnPyTh2a0O4qyiZfFSkzFVRysvIX5gRg+Xz1MLoE WZYUpCQcKdGtjjaf9xSUWGjKnyq7jyqWz074zzCYz2qZY9FURD4DZLRlbEWSCU82 X9+hpCMJ2vMKYkZdCylqdEhvrQ8zk/+g+LI6Dy0IE+s0WJzKYP6+syvJszBgwRZQ ZtW1Y/fwd/FC+bTZCj2z8iE0jEfsX9TiYqrg0oPpemsotu0SuXuxCgbb9M1rCDqo wsHlv1T1hMtwY+RdekKjwU46kksM3DH7zfOYwVYjuvgETd/vsDQUbRdFk5gxt4Xc aksL+iD4mYgy+iMU1HttpL1sqUGm6ZH2d5rSuLBDYNBgNaeBP7MDEzHsshBUi4HC VOSPaDoxvYDbLCC5A91M+9nQQngSPN/7m3GNL46xvbymAa68/6V7ZyWK9QinXWhD SJq40fMDXpzfVtqeUyRGNLeA37UPaewVG6/94fgNUf4hRdwvTNHdL6+2eE7Qpun5 KkxMBcxCH0Xyxn1wGg9QvCejFKe/PK9NE3/kphuEohNbKFG/jQa2J8MRw+PJBiMS GUBEkovItdQ=flWB -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce