ubuntu/+source/nginx:applied/ubuntu/xenial-security

Last commit made on 2018-11-07
Get this branch:
git clone -b applied/ubuntu/xenial-security https://git.launchpad.net/ubuntu/+source/nginx
Members of Ubuntu Server Dev import team can upload to this branch. Log in for directions.

Branch merges

Branch information

Name:
applied/ubuntu/xenial-security
Repository:
lp:ubuntu/+source/nginx

Recent commits

17f460a... by Marc Deslauriers on 2018-11-06

Import patches-applied version 1.10.3-0ubuntu0.16.04.3 to applied/ubuntu/xenial-security

Imported using git-ubuntu import.

Changelog parent: c519c8dace205cc5f15c5de4361d69fd8e05fcf4
Unapplied parent: 2b00fd0e93dad3ca629747d07135a4590606fd5d

New changelog entries:
  * SECURITY UPDATE: excessive memory consumption in HTTP/2 implementation
    - debian/patches/CVE-2018-16843.patch: add flood detection in
      src/http/v2/ngx_http_v2.c, src/http/v2/ngx_http_v2.h.
    - CVE-2018-16843
  * SECURITY UPDATE: excessive CPU usage in HTTP/2 implementation
    - debian/patches/CVE-2018-16844-pre.patch: backport new
      http2_max_requests directive.
    - debian/patches/CVE-2018-16844.patch: limit the number of idle state
      switches in src/http/v2/ngx_http_v2.c, src/http/v2/ngx_http_v2.h.
    - CVE-2018-16844
  * SECURITY UPDATE: infinite loop in ngx_http_mp4_module
    - debian/patches/CVE-2018-16845.patch: fixed reading 64-bit atoms in
      src/http/modules/ngx_http_mp4_module.c.
    - CVE-2018-16845

2b00fd0... by Marc Deslauriers on 2018-11-06

CVE-2018-16845.patch

No DEP3 Subject or Description header found

Gbp-Pq: CVE-2018-16845.patch.

6fa1079... by Marc Deslauriers on 2018-11-06

CVE-2018-16844.patch

No DEP3 Subject or Description header found

Gbp-Pq: CVE-2018-16844.patch.

ee9cd2b... by Marc Deslauriers on 2018-11-06

CVE-2018-16844-pre.patch

No DEP3 Subject or Description header found

Gbp-Pq: CVE-2018-16844-pre.patch.

805863f... by Marc Deslauriers on 2018-11-06

CVE-2018-16843.patch

No DEP3 Subject or Description header found

Gbp-Pq: CVE-2018-16843.patch.

99a221c... by Marc Deslauriers on 2018-11-06

Fix integer overflow in the range filter

Gbp-Pq: CVE-2017-7529.patch.

0c88a55... by Marc Deslauriers on 2018-11-06

Add Ubuntu token to NGINX_VER

Gbp-Pq: ubuntu-branding.patch.

7f8be1a... by Marc Deslauriers on 2018-11-06

Use linker flags from environment for perl (dpkg-buildflags).

Gbp-Pq: perl-use-dpkg-buildflags.patch.

7f02e68... by Marc Deslauriers on 2018-11-06

Import patches-unapplied version 1.10.3-0ubuntu0.16.04.3 to ubuntu/xenial-security

Imported using git-ubuntu import.

Changelog parent: 51e1e5c69630b0286ce0887d9c4bd337d9d1ec98

New changelog entries:
  * SECURITY UPDATE: excessive memory consumption in HTTP/2 implementation
    - debian/patches/CVE-2018-16843.patch: add flood detection in
      src/http/v2/ngx_http_v2.c, src/http/v2/ngx_http_v2.h.
    - CVE-2018-16843
  * SECURITY UPDATE: excessive CPU usage in HTTP/2 implementation
    - debian/patches/CVE-2018-16844-pre.patch: backport new
      http2_max_requests directive.
    - debian/patches/CVE-2018-16844.patch: limit the number of idle state
      switches in src/http/v2/ngx_http_v2.c, src/http/v2/ngx_http_v2.h.
    - CVE-2018-16844
  * SECURITY UPDATE: infinite loop in ngx_http_mp4_module
    - debian/patches/CVE-2018-16845.patch: fixed reading 64-bit atoms in
      src/http/modules/ngx_http_mp4_module.c.
    - CVE-2018-16845

51e1e5c... by Steve Beattie on 2017-07-12

Import patches-unapplied version 1.10.3-0ubuntu0.16.04.2 to ubuntu/xenial-security

Imported using git-ubuntu import.

Changelog parent: ce2df53a681e7f2a1dab83adca148c93b3b68abd

New changelog entries:
  * SECURITY UPDATE: integer overflow in range filter leading to
    information exposure
    - debian/patches/CVE-2017-7529.patch: add check to ensure size does
      not overflow
    - CVE-2017-7529