There were three vulnerabilities discovered by Netflix in NGINX: CVE-2019-9511, CVE-2019-9513 and CVE-2019-9516. Both current stable1 and mainline2 were patched and point releases had been issued. As I mentioned in my NGINX Extended post I was not going to work on 1.14.x branch any more with the exception of security updates. Canonical backported patches to their nginx package3 with the following changelog:
- SECURITY UPDATE: HTTP/2 Data Dribble issue
–debian/patches/CVE-2019-9511.patch: limited number of DATA frames insrc/http/v2/ngx_http_v2.c,src/http/v2/ngx_http_v2.h,src/http/v2/ngx_http_v2_filter_module.c.
– CVE-2019-9511 - SECURITY UPDATE: HTTP/2 Resource Loop / Priority Shuffling issue
–debian/patches/CVE-2019-9513.patch: limited number of PRIORITY frames insrc/http/v2/ngx_http_v2.c,src/http/v2/ngx_http_v2.h.
– CVE-2019-9513 - SECURITY UPDATE: HTTP/2 0-Length Headers Leak issue
–debian/patches/CVE-2019-9516.patch: reject zero length headers with PROTOCOL_ERROR insrc/http/v2/ngx_http_v2.c.
– CVE-2019-9516
I also took these patches and rebuilt my NGINX Extended version.4
Having this opportunity I thought it’s worth mentioning that there’s also Docker container available with my NGINX version. Dockerfile is available on GitHub and image itself on Docker Hub. Internally it’s also using my PPA to provide the package so it has exactly the same version as the one provided there.