Your message dated Sat, 18 Jul 2020 13:07:00 +0100
with message-id
<b8d89cdfeeda7b6d1ef96a8706a20f9525c2151b.ca...@adam-barratt.org.uk>
and subject line Closing requests for fixes included in 9.13 point release
has caused the Debian Bug report #948650,
regarding stretch-pu: package nginx/1.10.3-1+deb9u3
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
948650: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=948650
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: stretch
User: release.debian....@packages.debian.org
Usertags: pu
Hello,
I'd like to upload nginx 1.10.3-1+deb9u4, addressing the non-critical
CVE-2019-20372.
Attaching a debdiff.
[0] https://security-tracker.debian.org/tracker/CVE-2019-20372
[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=948579
-- System Information:
Debian Release: 10.2
APT prefers unstable-debug
APT policy: (500, 'unstable-debug'), (500, 'testing-debug'), (500, 'stable'),
(4, 'unstable'), (2, 'testing'), (1, 'experimental-debug'), (1, 'experimental')
Architecture: amd64 (x86_64)
Kernel: Linux 4.19.0-6-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8),
LANGUAGE=en_US:en (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
diff -Nru nginx-1.10.3/debian/changelog nginx-1.10.3/debian/changelog
--- nginx-1.10.3/debian/changelog 2019-08-19 12:31:19.000000000 +0300
+++ nginx-1.10.3/debian/changelog 2020-01-11 09:28:05.000000000 +0200
@@ -1,3 +1,10 @@
+nginx (1.10.3-1+deb9u4) stretch; urgency=medium
+
+ * Handle CVE-2019-20372, error page request smuggling
+ (Closes: #948579)
+
+ -- Christos Trochalakis <ctrochala...@debian.org> Sat, 11 Jan 2020 09:28:05
+0200
+
nginx (1.10.3-1+deb9u3) stretch-security; urgency=high
* Backport upstream fixes for 3 CVEs (Closes: #935037)
diff -Nru nginx-1.10.3/debian/patches/CVE-2019-20372.patch
nginx-1.10.3/debian/patches/CVE-2019-20372.patch
--- nginx-1.10.3/debian/patches/CVE-2019-20372.patch 1970-01-01
02:00:00.000000000 +0200
+++ nginx-1.10.3/debian/patches/CVE-2019-20372.patch 2020-01-11
09:28:05.000000000 +0200
@@ -0,0 +1,31 @@
+From 8bffc01d084b4881e3eed2052c115b8f04268cb9 Mon Sep 17 00:00:00 2001
+From: Ruslan Ermilov <r...@nginx.com>
+Date: Mon, 23 Dec 2019 15:45:46 +0300
+Subject: [PATCH] Discard request body when redirecting to a URL via
+ error_page.
+
+Reported by Bert JW Regeer and Francisco Oca Gonzalez.
+---
+ src/http/ngx_http_special_response.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/src/http/ngx_http_special_response.c
b/src/http/ngx_http_special_response.c
+index 2c1ff174..e2a5e9dc 100644
+--- a/src/http/ngx_http_special_response.c
++++ b/src/http/ngx_http_special_response.c
+@@ -623,6 +623,12 @@ ngx_http_send_error_page(ngx_http_request_t *r,
ngx_http_err_page_t *err_page)
+ return ngx_http_named_location(r, &uri);
+ }
+
++ r->expect_tested = 1;
++
++ if (ngx_http_discard_request_body(r) != NGX_OK) {
++ r->keepalive = 0;
++ }
++
+ location = ngx_list_push(&r->headers_out.headers);
+
+ if (location == NULL) {
+--
+2.23.0
+
diff -Nru nginx-1.10.3/debian/patches/series nginx-1.10.3/debian/patches/series
--- nginx-1.10.3/debian/patches/series 2019-08-19 12:31:19.000000000 +0300
+++ nginx-1.10.3/debian/patches/series 2020-01-11 09:28:05.000000000 +0200
@@ -13,3 +13,4 @@
CVE-2019-9516.patch
CVE-2019-9511.patch
CVE-2019-9513.patch
+CVE-2019-20372.patch
signature.asc
Description: PGP signature
--- End Message ---
--- Begin Message ---
Package: release.debian.org
Version: 9.13
Hi,
All of these requests relate to updates that were included in today's
stretch point release.
Regards,
Adam
--- End Message ---
