-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: nginx:1.16 security update Advisory ID: RHSA-2021:2290-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:2290 Issue date: 2021-06-08 CVE Names: CVE-2021-23017 ===================================================================== 1. Summary: An update for the nginx:1.16 module is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.1 Extended Update Support, and Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64 Red Hat Enterprise Linux AppStream EUS (v. 8.1) - aarch64, noarch, ppc64le, s390x, x86_64 Red Hat Enterprise Linux AppStream EUS (v. 8.2) - aarch64, noarch, ppc64le, s390x, x86_64 3. Description: nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: Off-by-one in ngx_resolver_copy() when labels are followed by a pointer to a root domain name (CVE-2021-23017) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1963121 - CVE-2021-23017 nginx: Off-by-one in ngx_resolver_copy() when labels are followed by a pointer to a root domain name 6. Package List: Red Hat Enterprise Linux AppStream EUS (v. 8.1): Source: nginx-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.src.rpm aarch64: nginx-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.aarch64.rpm nginx-debuginfo-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.aarch64.rpm nginx-debugsource-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.aarch64.rpm nginx-mod-http-image-filter-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.aarch64.rpm nginx-mod-http-image-filter-debuginfo-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.aarch64.rpm nginx-mod-http-perl-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.aarch64.rpm nginx-mod-http-perl-debuginfo-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.aarch64.rpm nginx-mod-http-xslt-filter-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.aarch64.rpm nginx-mod-http-xslt-filter-debuginfo-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.aarch64.rpm nginx-mod-mail-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.aarch64.rpm nginx-mod-mail-debuginfo-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.aarch64.rpm nginx-mod-stream-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.aarch64.rpm nginx-mod-stream-debuginfo-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.aarch64.rpm noarch: nginx-all-modules-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.noarch.rpm nginx-filesystem-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.noarch.rpm ppc64le: nginx-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.ppc64le.rpm nginx-debuginfo-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.ppc64le.rpm nginx-debugsource-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.ppc64le.rpm nginx-mod-http-image-filter-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.ppc64le.rpm nginx-mod-http-image-filter-debuginfo-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.ppc64le.rpm nginx-mod-http-perl-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.ppc64le.rpm nginx-mod-http-perl-debuginfo-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.ppc64le.rpm nginx-mod-http-xslt-filter-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.ppc64le.rpm nginx-mod-http-xslt-filter-debuginfo-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.ppc64le.rpm nginx-mod-mail-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.ppc64le.rpm nginx-mod-mail-debuginfo-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.ppc64le.rpm nginx-mod-stream-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.ppc64le.rpm nginx-mod-stream-debuginfo-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.ppc64le.rpm s390x: nginx-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.s390x.rpm nginx-debuginfo-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.s390x.rpm nginx-debugsource-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.s390x.rpm nginx-mod-http-image-filter-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.s390x.rpm nginx-mod-http-image-filter-debuginfo-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.s390x.rpm nginx-mod-http-perl-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.s390x.rpm nginx-mod-http-perl-debuginfo-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.s390x.rpm nginx-mod-http-xslt-filter-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.s390x.rpm nginx-mod-http-xslt-filter-debuginfo-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.s390x.rpm nginx-mod-mail-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.s390x.rpm nginx-mod-mail-debuginfo-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.s390x.rpm nginx-mod-stream-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.s390x.rpm nginx-mod-stream-debuginfo-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.s390x.rpm x86_64: nginx-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.x86_64.rpm nginx-debuginfo-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.x86_64.rpm nginx-debugsource-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.x86_64.rpm nginx-mod-http-image-filter-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.x86_64.rpm nginx-mod-http-image-filter-debuginfo-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.x86_64.rpm nginx-mod-http-perl-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.x86_64.rpm nginx-mod-http-perl-debuginfo-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.x86_64.rpm nginx-mod-http-xslt-filter-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.x86_64.rpm nginx-mod-http-xslt-filter-debuginfo-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.x86_64.rpm nginx-mod-mail-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.x86_64.rpm nginx-mod-mail-debuginfo-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.x86_64.rpm nginx-mod-stream-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.x86_64.rpm nginx-mod-stream-debuginfo-1.16.1-1.module+el8.1.0+11153+6c3a40a9.1.x86_64.rpm Red Hat Enterprise Linux AppStream EUS (v. 8.2): Source: nginx-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.src.rpm aarch64: nginx-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.aarch64.rpm nginx-debuginfo-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.aarch64.rpm nginx-debugsource-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.aarch64.rpm nginx-mod-http-image-filter-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.aarch64.rpm nginx-mod-http-image-filter-debuginfo-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.aarch64.rpm nginx-mod-http-perl-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.aarch64.rpm nginx-mod-http-perl-debuginfo-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.aarch64.rpm nginx-mod-http-xslt-filter-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.aarch64.rpm nginx-mod-http-xslt-filter-debuginfo-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.aarch64.rpm nginx-mod-mail-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.aarch64.rpm nginx-mod-mail-debuginfo-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.aarch64.rpm nginx-mod-stream-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.aarch64.rpm nginx-mod-stream-debuginfo-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.aarch64.rpm noarch: nginx-all-modules-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.noarch.rpm nginx-filesystem-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.noarch.rpm ppc64le: nginx-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.ppc64le.rpm nginx-debuginfo-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.ppc64le.rpm nginx-debugsource-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.ppc64le.rpm nginx-mod-http-image-filter-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.ppc64le.rpm nginx-mod-http-image-filter-debuginfo-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.ppc64le.rpm nginx-mod-http-perl-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.ppc64le.rpm nginx-mod-http-perl-debuginfo-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.ppc64le.rpm nginx-mod-http-xslt-filter-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.ppc64le.rpm nginx-mod-http-xslt-filter-debuginfo-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.ppc64le.rpm nginx-mod-mail-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.ppc64le.rpm nginx-mod-mail-debuginfo-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.ppc64le.rpm nginx-mod-stream-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.ppc64le.rpm nginx-mod-stream-debuginfo-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.ppc64le.rpm s390x: nginx-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.s390x.rpm nginx-debuginfo-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.s390x.rpm nginx-debugsource-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.s390x.rpm nginx-mod-http-image-filter-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.s390x.rpm nginx-mod-http-image-filter-debuginfo-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.s390x.rpm nginx-mod-http-perl-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.s390x.rpm nginx-mod-http-perl-debuginfo-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.s390x.rpm nginx-mod-http-xslt-filter-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.s390x.rpm nginx-mod-http-xslt-filter-debuginfo-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.s390x.rpm nginx-mod-mail-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.s390x.rpm nginx-mod-mail-debuginfo-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.s390x.rpm nginx-mod-stream-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.s390x.rpm nginx-mod-stream-debuginfo-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.s390x.rpm x86_64: nginx-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.x86_64.rpm nginx-debuginfo-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.x86_64.rpm nginx-debugsource-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.x86_64.rpm nginx-mod-http-image-filter-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.x86_64.rpm nginx-mod-http-image-filter-debuginfo-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.x86_64.rpm nginx-mod-http-perl-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.x86_64.rpm nginx-mod-http-perl-debuginfo-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.x86_64.rpm nginx-mod-http-xslt-filter-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.x86_64.rpm nginx-mod-http-xslt-filter-debuginfo-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.x86_64.rpm nginx-mod-mail-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.x86_64.rpm nginx-mod-mail-debuginfo-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.x86_64.rpm nginx-mod-stream-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.x86_64.rpm nginx-mod-stream-debuginfo-1.16.1-1.module+el8.2.0+11154+636e4c3b.1.x86_64.rpm Red Hat Enterprise Linux AppStream (v. 8): Source: nginx-1.16.1-2.module+el8.4.0+11155+68135136.1.src.rpm aarch64: nginx-1.16.1-2.module+el8.4.0+11155+68135136.1.aarch64.rpm nginx-debuginfo-1.16.1-2.module+el8.4.0+11155+68135136.1.aarch64.rpm nginx-debugsource-1.16.1-2.module+el8.4.0+11155+68135136.1.aarch64.rpm nginx-mod-http-image-filter-1.16.1-2.module+el8.4.0+11155+68135136.1.aarch64.rpm nginx-mod-http-image-filter-debuginfo-1.16.1-2.module+el8.4.0+11155+68135136.1.aarch64.rpm nginx-mod-http-perl-1.16.1-2.module+el8.4.0+11155+68135136.1.aarch64.rpm nginx-mod-http-perl-debuginfo-1.16.1-2.module+el8.4.0+11155+68135136.1.aarch64.rpm nginx-mod-http-xslt-filter-1.16.1-2.module+el8.4.0+11155+68135136.1.aarch64.rpm nginx-mod-http-xslt-filter-debuginfo-1.16.1-2.module+el8.4.0+11155+68135136.1.aarch64.rpm nginx-mod-mail-1.16.1-2.module+el8.4.0+11155+68135136.1.aarch64.rpm nginx-mod-mail-debuginfo-1.16.1-2.module+el8.4.0+11155+68135136.1.aarch64.rpm nginx-mod-stream-1.16.1-2.module+el8.4.0+11155+68135136.1.aarch64.rpm nginx-mod-stream-debuginfo-1.16.1-2.module+el8.4.0+11155+68135136.1.aarch64.rpm noarch: nginx-all-modules-1.16.1-2.module+el8.4.0+11155+68135136.1.noarch.rpm nginx-filesystem-1.16.1-2.module+el8.4.0+11155+68135136.1.noarch.rpm ppc64le: nginx-1.16.1-2.module+el8.4.0+11155+68135136.1.ppc64le.rpm nginx-debuginfo-1.16.1-2.module+el8.4.0+11155+68135136.1.ppc64le.rpm nginx-debugsource-1.16.1-2.module+el8.4.0+11155+68135136.1.ppc64le.rpm nginx-mod-http-image-filter-1.16.1-2.module+el8.4.0+11155+68135136.1.ppc64le.rpm nginx-mod-http-image-filter-debuginfo-1.16.1-2.module+el8.4.0+11155+68135136.1.ppc64le.rpm nginx-mod-http-perl-1.16.1-2.module+el8.4.0+11155+68135136.1.ppc64le.rpm nginx-mod-http-perl-debuginfo-1.16.1-2.module+el8.4.0+11155+68135136.1.ppc64le.rpm nginx-mod-http-xslt-filter-1.16.1-2.module+el8.4.0+11155+68135136.1.ppc64le.rpm nginx-mod-http-xslt-filter-debuginfo-1.16.1-2.module+el8.4.0+11155+68135136.1.ppc64le.rpm nginx-mod-mail-1.16.1-2.module+el8.4.0+11155+68135136.1.ppc64le.rpm nginx-mod-mail-debuginfo-1.16.1-2.module+el8.4.0+11155+68135136.1.ppc64le.rpm nginx-mod-stream-1.16.1-2.module+el8.4.0+11155+68135136.1.ppc64le.rpm nginx-mod-stream-debuginfo-1.16.1-2.module+el8.4.0+11155+68135136.1.ppc64le.rpm s390x: nginx-1.16.1-2.module+el8.4.0+11155+68135136.1.s390x.rpm nginx-debuginfo-1.16.1-2.module+el8.4.0+11155+68135136.1.s390x.rpm nginx-debugsource-1.16.1-2.module+el8.4.0+11155+68135136.1.s390x.rpm nginx-mod-http-image-filter-1.16.1-2.module+el8.4.0+11155+68135136.1.s390x.rpm nginx-mod-http-image-filter-debuginfo-1.16.1-2.module+el8.4.0+11155+68135136.1.s390x.rpm nginx-mod-http-perl-1.16.1-2.module+el8.4.0+11155+68135136.1.s390x.rpm nginx-mod-http-perl-debuginfo-1.16.1-2.module+el8.4.0+11155+68135136.1.s390x.rpm nginx-mod-http-xslt-filter-1.16.1-2.module+el8.4.0+11155+68135136.1.s390x.rpm nginx-mod-http-xslt-filter-debuginfo-1.16.1-2.module+el8.4.0+11155+68135136.1.s390x.rpm nginx-mod-mail-1.16.1-2.module+el8.4.0+11155+68135136.1.s390x.rpm nginx-mod-mail-debuginfo-1.16.1-2.module+el8.4.0+11155+68135136.1.s390x.rpm nginx-mod-stream-1.16.1-2.module+el8.4.0+11155+68135136.1.s390x.rpm nginx-mod-stream-debuginfo-1.16.1-2.module+el8.4.0+11155+68135136.1.s390x.rpm x86_64: nginx-1.16.1-2.module+el8.4.0+11155+68135136.1.x86_64.rpm nginx-debuginfo-1.16.1-2.module+el8.4.0+11155+68135136.1.x86_64.rpm nginx-debugsource-1.16.1-2.module+el8.4.0+11155+68135136.1.x86_64.rpm nginx-mod-http-image-filter-1.16.1-2.module+el8.4.0+11155+68135136.1.x86_64.rpm nginx-mod-http-image-filter-debuginfo-1.16.1-2.module+el8.4.0+11155+68135136.1.x86_64.rpm nginx-mod-http-perl-1.16.1-2.module+el8.4.0+11155+68135136.1.x86_64.rpm nginx-mod-http-perl-debuginfo-1.16.1-2.module+el8.4.0+11155+68135136.1.x86_64.rpm nginx-mod-http-xslt-filter-1.16.1-2.module+el8.4.0+11155+68135136.1.x86_64.rpm nginx-mod-http-xslt-filter-debuginfo-1.16.1-2.module+el8.4.0+11155+68135136.1.x86_64.rpm nginx-mod-mail-1.16.1-2.module+el8.4.0+11155+68135136.1.x86_64.rpm nginx-mod-mail-debuginfo-1.16.1-2.module+el8.4.0+11155+68135136.1.x86_64.rpm nginx-mod-stream-1.16.1-2.module+el8.4.0+11155+68135136.1.x86_64.rpm nginx-mod-stream-debuginfo-1.16.1-2.module+el8.4.0+11155+68135136.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2021-23017 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYL9JUNzjgjWX9erEAQjSfA/9H4Lh2lGSkUcGMgFMdswHlGjLWsVw88oj E8RnhgJTjDvtRGf+9f6+l2idvZ8Yu9vqDeLMGIPA1DeL4qY1cf9ONQWAUgQTXfc3 UbzeEL6xJJO8+3UWWj/QS8bamTAQ0AlcC8t6lY54bjsKpwJQbzqlKlCLDbtFHERj K8ya6dpSU2MBHaIZ0TAoM0I/rpfVrT4pzwJkmRuum5vGE/BDw2uykGCyV2MhcGfo SwhQBlsahaGGALWm6qX1sODtLgyM7o5ew006x0rmUnK36PoLyaR2J0dELDs+s/vd VgSzejuChb+OTauUvQ1r52DDojfzVxFwVkNjJ2N8nJnPOrHwLnYEfyFSVEcaO9MC wCFgEX1NSQ1k4O0kh/yADz19xPuhDN6uMUzDwg7X2rJJsWoaUEQlDWivM8J6D21R XFyOiA9AcIw3sU8TkBEhuNIaYnWlO4s9pF8ArEI7+Z6Npo5XHnYRktS3dK1Aa1A4 Eh4ziunoXJJqCX+1EveVIOSNCDPq/9CyU8iOCMZOQi67Id6Hhi1aRJ1UNw1oiR4k 1X/I+oWRrl3BSEKVBPWNCN0qCV97bwjl6wW9+PXhIDMe5dSNIF5zZ7o7smbCl3ix OBRavPU6umfqzWre430GMfMsj1VFx8Sj6gU7WPTeGWBgPW4tCUzj5d+C8CW0llH9 +wyUMMhwDBE= =GAHo -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce