[arch-security] [ASA-201707-11] nginx: information disclosure

[Remi Gacogne]

Arch Linux Security Advisory ASA-201707-11
==========================================

Severity: High
Date    : 2017-07-12
CVE-ID  : CVE-2017-7529
Package : nginx
Type    : information disclosure
Remote  : Yes
Link    : https://security.archlinux.org/AVG-345

Summary
=======

The package nginx before version 1.12.1-1 is vulnerable to information
disclosure.

Resolution
==========

Upgrade to 1.12.1-1.

# pacman -Syu "nginx>=1.12.1-1"

The problem has been fixed upstream in version 1.12.1.

Workaround
==========

None.

Description
===========

A security issue was identified in the range filter module of nginx <
1.13.3. A specially crafted request might result in an integer overflow
and incorrect processing of ranges, potentially resulting in sensitive
information leak.
When using nginx with standard modules this allows an attacker to
obtain a cache file header if a response was returned from cache. In
some configurations a cache file header may contain IP address of the
backend server or other sensitive information. Besides, with 3rd party
modules it is potentially possible that the issue may lead to a denial
of service or a disclosure of a worker process memory. No such modules
are currently known though.

Impact
======

A remote attacker can access sensitive information by sending a
specially crafted request.

References
==========

http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.html
https://nginx.org/download/patch.2017.ranges.txt
https://security.archlinux.org/CVE-2017-7529

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20170712/ce526059/attachment.asc>