[manjaro-security] [arch-security] [ASA-201707-12] nginx-mainline: information disclosure

[Remi Gacogne]

Arch Linux Security Advisory ASA-201707-12
==========================================

Severity: High
Date    : 2017-07-12
CVE-ID  : CVE-2017-7529
Package : nginx-mainline
Type    : information disclosure
Remote  : Yes
Link    : https://security.archlinux.org/AVG-346

Summary
=======

The package nginx-mainline before version 1.13.3-1 is vulnerable to
information disclosure.

Resolution
==========

Upgrade to 1.13.3-1.

# pacman -Syu "nginx-mainline>=1.13.3-1"

The problem has been fixed upstream in version 1.13.3.

Workaround
==========

None.

Description
===========

A security issue was identified in the range filter module of nginx <
1.13.3. A specially crafted request might result in an integer overflow
and incorrect processing of ranges, potentially resulting in sensitive
information leak.
When using nginx with standard modules this allows an attacker to
obtain a cache file header if a response was returned from cache. In
some configurations a cache file header may contain IP address of the
backend server or other sensitive information. Besides, with 3rd party
modules it is potentially possible that the issue may lead to a denial
of service or a disclosure of a worker process memory. No such modules
are currently known though.

Impact
======

A remote attacker can access sensitive information by sending a
specially crafted request.

References
==========

http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.html
https://nginx.org/download/patch.2017.ranges.txt
https://security.archlinux.org/CVE-2017-7529

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://lists.manjaro.org/pipermail/manjaro-security/attachments/20170712/98e4e53b/attachment.sig>