NGINX Extended Security Update →

Aug 17, 2019

There were three vulnerabilities discovered by Netflix in NGINX: CVE-2019-9511, CVE-2019-9513 and CVE-2019-9516. Both current stable¹ and mainline² were patched and point releases had been issued. As I mentioned in my NGINX Extended post I was not going to work on 1.14.x branch any more with the exception of security updates. Canonical backported patches to their nginx package³ with the following changelog:

• SECURITY UPDATE: HTTP/2 Data Dribble issue
  debian/patches/CVE-2019-9511.patch: limited number of DATA frames in src/http/v2/ngx_http_v2.c, src/http/v2/ngx_http_v2.h, src/http/v2/ngx_http_v2_filter_module.c.
  CVE-2019-9511
• SECURITY UPDATE: HTTP/2 Resource Loop / Priority Shuffling issue
  debian/patches/CVE-2019-9513.patch: limited number of PRIORITY frames in src/http/v2/ngx_http_v2.c, src/http/v2/ngx_http_v2.h.
  CVE-2019-9513
• SECURITY UPDATE: HTTP/2 0-Length Headers Leak issue
  debian/patches/CVE-2019-9516.patch: reject zero length headers with PROTOCOL_ERROR in src/http/v2/ngx_http_v2.c.
  CVE-2019-9516

I also took these patches and rebuilt my NGINX Extended version.⁴

Having this opportunity I thought it’s worth mentioning that there’s also Docker container available with my NGINX version. Dockerfile is available on GitHub and image itself on Docker Hub. Internally it’s also using my PPA to provide the package so it has exactly the same version as the one provided there.