USN-4967-1: nginx vulnerability

Releases

• Ubuntu 21.04
• Ubuntu 20.10
• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM

Packages

• nginx - small, powerful, scalable web/proxy server

Details

Luis Merino, Markus Vervier, and Eric Sesterhenn discovered that nginx
incorrectly handled responses to the DNS resolver. A remote attacker could
use this issue to cause nginx to crash, resulting in a denial of service,
or possibly execute arbitrary code.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 21.04

• nginx-common - 1.18.0-6ubuntu8.2
• nginx-extras - 1.18.0-6ubuntu8.2
• nginx-core - 1.18.0-6ubuntu8.2
• nginx - 1.18.0-6ubuntu8.2
• nginx-light - 1.18.0-6ubuntu8.2
• nginx-full - 1.18.0-6ubuntu8.2

Ubuntu 20.10

• nginx-common - 1.18.0-6ubuntu2.2
• nginx - 1.18.0-6ubuntu2.2
• nginx-light - 1.18.0-6ubuntu2.2
• nginx-extras - 1.18.0-6ubuntu2.2
• nginx-core - 1.18.0-6ubuntu2.2
• nginx-full - 1.18.0-6ubuntu2.2

Ubuntu 20.04

• nginx-common - 1.18.0-0ubuntu1.2
• nginx-extras - 1.18.0-0ubuntu1.2
• nginx-core - 1.18.0-0ubuntu1.2
• nginx - 1.18.0-0ubuntu1.2
• nginx-light - 1.18.0-0ubuntu1.2
• nginx-full - 1.18.0-0ubuntu1.2

Ubuntu 18.04

• nginx-common - 1.14.0-0ubuntu1.9
• nginx-extras - 1.14.0-0ubuntu1.9
• nginx-core - 1.14.0-0ubuntu1.9
• nginx - 1.14.0-0ubuntu1.9
• nginx-light - 1.14.0-0ubuntu1.9
• nginx-full - 1.14.0-0ubuntu1.9

In general, a standard system update will make all the necessary changes.

References

• CVE-2021-23017

Related notices

• USN-4967-2: nginx-naxsi-ui, nginx-core, nginx-full, nginx-extras, nginx-naxsi, nginx-light, nginx-doc, nginx-common, nginx