From 83cf15ff58d3fe7f11c23cdde8575383d3c8459e Mon Sep 17 00:00:00 2001
From: CentOS Sources <bugs@centos.org>
Date: Tue, 30 Mar 2021 06:50:36 -0400
Subject: [PATCH] import nginx-1.16.1-1.module+el8.3.0+8844+e5e7039f.1

---
 SOURCES/nginx-1.16.1-CVE-2019-20372.patch | 17 +++++++++++++++++
 SPECS/nginx.spec                          | 10 +++++++++-
 2 files changed, 26 insertions(+), 1 deletion(-)
 create mode 100644 SOURCES/nginx-1.16.1-CVE-2019-20372.patch

diff --git a/SOURCES/nginx-1.16.1-CVE-2019-20372.patch b/SOURCES/nginx-1.16.1-CVE-2019-20372.patch
new file mode 100644
index 0000000..782e038
--- /dev/null
+++ b/SOURCES/nginx-1.16.1-CVE-2019-20372.patch
@@ -0,0 +1,17 @@
+diff --git a/src/http/ngx_http_special_response.c b/src/http/ngx_http_special_response.c
+index 4ffb2cc8ad..76e6705889 100644
+--- a/src/http/ngx_http_special_response.c
++++ b/src/http/ngx_http_special_response.c
+@@ -623,6 +623,12 @@ ngx_http_send_error_page(ngx_http_request_t *r, ngx_http_err_page_t *err_page)
+         return ngx_http_named_location(r, &uri);
+     }
+ 
++    r->expect_tested = 1;
++
++    if (ngx_http_discard_request_body(r) != NGX_OK) {
++        r->keepalive = 0;
++    }
++
+     location = ngx_list_push(&r->headers_out.headers);
+ 
+     if (location == NULL) {
diff --git a/SPECS/nginx.spec b/SPECS/nginx.spec
index 09a2f5b..ceefce8 100644
--- a/SPECS/nginx.spec
+++ b/SPECS/nginx.spec
@@ -19,7 +19,7 @@
 Name:              nginx
 Epoch:             1
 Version:           1.16.1
-Release:           1%{?dist}
+Release:           1%{?dist}.1
 
 Summary:           A high performance web server and reverse proxy server
 Group:             System Environment/Daemons
@@ -59,6 +59,9 @@ Patch3:            nginx-1.14.1-perl-module-hardening.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=1643647
 Patch4:            nginx-1.16.0-enable-tls1v3-by-default.patch
 
+# https://bugzilla.redhat.com/show_bug.cgi?id=1790277
+Patch5:            nginx-1.16.1-CVE-2019-20372.patch
+
 %if 0%{?with_gperftools}
 BuildRequires:     gperftools-devel
 %endif
@@ -189,6 +192,7 @@ Requires:          nginx
 %patch2 -p1
 %patch3 -p1
 %patch4 -p1
+%patch5 -p1
 
 cp %{SOURCE200} %{SOURCE210} %{SOURCE10} %{SOURCE12} .
 
@@ -461,6 +465,10 @@ fi
 
 
 %changelog
+* Tue Nov 24 2020 Lubos Uhliarik <luhliari@redhat.com> - 1:1.16.1-1.1
+- Resolves: #1898952 - CVE 2019-20372 nginx:1.16/nginx: HTTP request smuggling
+  via error pages in http/ngx_http_special_response.c
+
 * Thu Aug 29 2019 Lubos Uhliarik <luhliari@redhat.com> - 1:1.16.1-1
 - update to 1.16.1
 - Resolves: #1745697 - CVE-2019-9511 nginx:1.16/nginx: HTTP/2: large amount