Your message dated Sat, 01 Aug 2020 12:51:28 +0100 with message-id <43535efb498a168cf81452ca0c326f004f46adc6.camel@adam-barratt.org.uk> and subject line Closing bugs for fixes included in 10.5 point release has caused the Debian Bug report #948652, regarding buster-pu: package nginx/1.14.2-2+deb10u2 to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact owner@bugs.debian.org immediately.) -- 948652: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=948652 Debian Bug Tracking System Contact owner@bugs.debian.org with problems
--- Begin Message ---
- To: Debian Bug Tracking System <submit@bugs.debian.org>
- Subject: buster-pu: package nginx/1.14.2-2+deb10u1
- From: Christos Trochalakis <ctrochalakis@debian.org>
- Date: Sat, 11 Jan 2020 12:24:47 +0200
- Message-id: <20200111102447.GA31932@luke.ws.skroutz.gr>
Package: release.debian.org Severity: normal Tags: buster User: release.debian.org@packages.debian.org Usertags: pu Hello, I'd like to upload nginx 1.14.2-2+deb10u2, addressing the non-critical CVE-2019-20372. Attaching a debdiff. [0] https://security-tracker.debian.org/tracker/CVE-2019-20372 [1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=948579 -- System Information: Debian Release: 10.2 APT prefers unstable-debug APT policy: (500, 'unstable-debug'), (500, 'testing-debug'), (500, 'stable'), (4, 'unstable'), (2, 'testing'), (1, 'experimental-debug'), (1, 'experimental') Architecture: amd64 (x86_64) Kernel: Linux 4.19.0-6-amd64 (SMP w/4 CPU cores) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system)diff -Nru nginx-1.14.2/debian/changelog nginx-1.14.2/debian/changelog --- nginx-1.14.2/debian/changelog 2019-08-13 21:10:28.000000000 +0300 +++ nginx-1.14.2/debian/changelog 2020-01-11 09:28:05.000000000 +0200 @@ -1,3 +1,10 @@ +nginx (1.14.2-2+deb10u2) buster; urgency=medium + + * Handle CVE-2019-20372, error page request smuggling + (Closes: #948579) + + -- Christos Trochalakis <ctrochalakis@debian.org> Sat, 11 Jan 2020 09:28:05 +0200 + nginx (1.14.2-2+deb10u1) buster-security; urgency=high * Backport upstream fixes for 3 CVEs (Closes: #935037) diff -Nru nginx-1.14.2/debian/patches/CVE-2019-20372.patch nginx-1.14.2/debian/patches/CVE-2019-20372.patch --- nginx-1.14.2/debian/patches/CVE-2019-20372.patch 1970-01-01 02:00:00.000000000 +0200 +++ nginx-1.14.2/debian/patches/CVE-2019-20372.patch 2020-01-11 09:28:05.000000000 +0200 @@ -0,0 +1,31 @@ +From 8bffc01d084b4881e3eed2052c115b8f04268cb9 Mon Sep 17 00:00:00 2001 +From: Ruslan Ermilov <ru@nginx.com> +Date: Mon, 23 Dec 2019 15:45:46 +0300 +Subject: [PATCH] Discard request body when redirecting to a URL via + error_page. + +Reported by Bert JW Regeer and Francisco Oca Gonzalez. +--- + src/http/ngx_http_special_response.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/src/http/ngx_http_special_response.c b/src/http/ngx_http_special_response.c +index 2c1ff174..e2a5e9dc 100644 +--- a/src/http/ngx_http_special_response.c ++++ b/src/http/ngx_http_special_response.c +@@ -623,6 +623,12 @@ ngx_http_send_error_page(ngx_http_request_t *r, ngx_http_err_page_t *err_page) + return ngx_http_named_location(r, &uri); + } + ++ r->expect_tested = 1; ++ ++ if (ngx_http_discard_request_body(r) != NGX_OK) { ++ r->keepalive = 0; ++ } ++ + location = ngx_list_push(&r->headers_out.headers); + + if (location == NULL) { +-- +2.23.0 + diff -Nru nginx-1.14.2/debian/patches/series nginx-1.14.2/debian/patches/series --- nginx-1.14.2/debian/patches/series 2019-08-13 21:10:28.000000000 +0300 +++ nginx-1.14.2/debian/patches/series 2020-01-11 09:28:05.000000000 +0200 @@ -3,3 +3,4 @@ CVE-2019-9516.patch CVE-2019-9511.patch CVE-2019-9513.patch +CVE-2019-20372.patchAttachment: signature.asc
Description: PGP signature
--- End Message ---
--- Begin Message ---
- To: 931678-done@bugs.debian.org, 947351-done@bugs.debian.org, 947758-done@bugs.debian.org, 948652-done@bugs.debian.org, 953763-done@bugs.debian.org, 954020-done@bugs.debian.org, 954716-done@bugs.debian.org, 959661-done@bugs.debian.org, 959890-done@bugs.debian.org, 960020-done@bugs.debian.org, 960376-done@bugs.debian.org, 960395-done@bugs.debian.org, 960575-done@bugs.debian.org, 960600-done@bugs.debian.org, 960804-done@bugs.debian.org, 960806-done@bugs.debian.org, 960836-done@bugs.debian.org, 960885-done@bugs.debian.org, 960974-done@bugs.debian.org, 961019-done@bugs.debian.org, 961212-done@bugs.debian.org, 961275-done@bugs.debian.org, 961379-done@bugs.debian.org, 961439-done@bugs.debian.org, 961441-done@bugs.debian.org, 961514-done@bugs.debian.org, 961803-done@bugs.debian.org, 961833-done@bugs.debian.org, 961921-done@bugs.debian.org, 961936-done@bugs.debian.org, 961944-done@bugs.debian.org, 961978-done@bugs.debian.org, 962059-done@bugs.debian.org, 962067-done@bugs.debian.org, 962160-done@bugs.debian.org, 962227-done@bugs.debian.org, 962237-done@bugs.debian.org, 962255-done@bugs.debian.org, 962306-done@bugs.debian.org, 962982-done@bugs.debian.org, 963024-done@bugs.debian.org, 963267-done@bugs.debian.org, 963591-done@bugs.debian.org, 963595-done@bugs.debian.org, 963694-done@bugs.debian.org, 963796-done@bugs.debian.org, 963940-done@bugs.debian.org, 963986-done@bugs.debian.org, 964146-done@bugs.debian.org, 964158-done@bugs.debian.org, 964228-done@bugs.debian.org, 964338-done@bugs.debian.org, 964346-done@bugs.debian.org, 964350-done@bugs.debian.org, 964397-done@bugs.debian.org, 964412-done@bugs.debian.org, 964417-done@bugs.debian.org, 964422-done@bugs.debian.org, 964435-done@bugs.debian.org, 964574-done@bugs.debian.org, 964589-done@bugs.debian.org, 964712-done@bugs.debian.org, 964714-done@bugs.debian.org, 964715-done@bugs.debian.org, 964726-done@bugs.debian.org, 964740-done@bugs.debian.org, 964792-done@bugs.debian.org, 964807-done@bugs.debian.org, 964808-done@bugs.debian.org, 964860-done@bugs.debian.org, 964868-done@bugs.debian.org, 964898-done@bugs.debian.org, 964986-done@bugs.debian.org, 965116-done@bugs.debian.org, 965117-done@bugs.debian.org, 965257-done@bugs.debian.org, 965377-done@bugs.debian.org, 966151-done@bugs.debian.org, 966213-done@bugs.debian.org, 966247-done@bugs.debian.org, 966272-done@bugs.debian.org, 966310-done@bugs.debian.org
- Subject: Closing bugs for fixes included in 10.5 point release
- From: "Adam D. Barratt" <adam@adam-barratt.org.uk>
- Date: Sat, 01 Aug 2020 12:51:28 +0100
- Message-id: <43535efb498a168cf81452ca0c326f004f46adc6.camel@adam-barratt.org.uk>
Package: release.debian.org Version: 10.5 Hi, Each of these bugs relates to an update that was included in today's stable point release. Regards, Adam
--- End Message ---