metalefty/nginx
1
0
Fork 0
forked from rpms/nginx
Code Pull Requests Activity

import nginx-1.16.1-1.module+el8.3.0+8844+e5e7039f.1

Browse Source
This commit is contained in:
CentOS Sources 2020-12-15 11:06:25 -05:00 committed by Andrew Lukoshko
parent f7b5d6ed2f
commit 17d8d3e413
2 changed files with 26 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
SOURCES/nginx-1.16.1-CVE-2019-20372.patch Normal file
View File

@ -0,0 +1,17 @@
diff --git a/src/http/ngx_http_special_response.c b/src/http/ngx_http_special_response.c
index 4ffb2cc8ad..76e6705889 100644
--- a/src/http/ngx_http_special_response.c
+++ b/src/http/ngx_http_special_response.c
@@ -623,6 +623,12 @@ ngx_http_send_error_page(ngx_http_request_t *r, ngx_http_err_page_t *err_page)
return ngx_http_named_location(r, &uri);
}
+ r->expect_tested = 1;
+
+ if (ngx_http_discard_request_body(r) != NGX_OK) {
+ r->keepalive = 0;
+ }
+
location = ngx_list_push(&r->headers_out.headers);
if (location == NULL) {

10
SPECS/nginx.spec
View File

@ -19,7 +19,7 @@
Name: nginx
Epoch: 1
Version: 1.16.1
Release: 1%{?dist}
Release: 1%{?dist}.1
Summary: A high performance web server and reverse proxy server
Group: System Environment/Daemons
@ -59,6 +59,9 @@ Patch3: nginx-1.14.1-perl-module-hardening.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=1643647
Patch4: nginx-1.16.0-enable-tls1v3-by-default.patch
# https://bugzilla.redhat.com/show_bug.cgi?id=1790277
Patch5: nginx-1.16.1-CVE-2019-20372.patch
%if 0%{?with_gperftools}
BuildRequires: gperftools-devel
%endif
@ -189,6 +192,7 @@ Requires: nginx
%patch2 -p1
%patch3 -p1
%patch4 -p1
%patch5 -p1
cp %{SOURCE200} %{SOURCE210} %{SOURCE10} %{SOURCE12} .
@ -461,6 +465,10 @@ fi
%changelog
* Tue Nov 24 2020 Lubos Uhliarik <luhliari@redhat.com> - 1:1.16.1-1.1
- Resolves: #1898952 - CVE 2019-20372 nginx:1.16/nginx: HTTP request smuggling
via error pages in http/ngx_http_special_response.c
* Thu Aug 29 2019 Lubos Uhliarik <luhliari@redhat.com> - 1:1.16.1-1
- update to 1.16.1
- Resolves: #1745697 - CVE-2019-9511 nginx:1.16/nginx: HTTP/2: large amount