Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2019-20372 →

DEBIAN-CVE-2019-20372

NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unau...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 nginx

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-3"}]}]

Debian:13 nginx

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-3"}]}]

Debian:14 nginx

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-3"}]}]

Références

advisory security-tracker.debian.org