There were three vulnerabilities discovered by Netflix in NGINX: CVE-2019-9511, CVE-2019-9513 and CVE-2019-9516. Both current stable and mainline were patched and point releases had been issued. As I mentioned in my NGINX Extended post I was not going to work on 1.14.x branch any more with the exception of security updates. Canonical backported patches to their nginx package with the following changelog:
- SECURITY UPDATE: HTTP/2 Data Dribble issue
debian/patches/CVE-2019-9511.patch: limited number of DATA frames in
- SECURITY UPDATE: HTTP/2 Resource Loop / Priority Shuffling issue
debian/patches/CVE-2019-9513.patch: limited number of PRIORITY frames in
- SECURITY UPDATE: HTTP/2 0-Length Headers Leak issue
debian/patches/CVE-2019-9516.patch: reject zero length headers with PROTOCOL_ERROR in
I also took these patches and rebuilt my NGINX Extended version.
Having this opportunity I thought it's worth mentioning that there's also Docker container available with my NGINX version.
Dockerfile is available on GitHub and image itself on Docker Hub. Internally it's also using my PPA to provide the package so it has exactly the same version as the one provided there.