Security update for nginx SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2020:0348-1 Final 1 1 2020-02-06T12:23:23Z current 2020-02-06T12:23:23Z 2020-02-06T12:23:23Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for nginx This update for nginx fixes the following issues: - CVE-2019-20372: Fixed an HTTP request smuggling with certain error_page configurations which could have allowed unauthorized web page reads (bsc#1160682). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES15-SP1-CAP-Deployment-BYOS-EC2-HVM-2020-348,Image SLES15-SP1-CAP-Deployment-BYOS-GCE-2020-348,SUSE-2020-348,SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2020-348,SUSE-SLE-Module-Server-Applications-15-SP1-2020-348 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2020/suse-su-20200348-1/ Link for SUSE-SU-2020:0348-1 https://lists.suse.com/pipermail/sle-security-updates/2020-February/006462.html E-Mail link for SUSE-SU-2020:0348-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1160682 SUSE Bug 1160682 https://www.suse.com/security/cve/CVE-2019-20372/ SUSE CVE CVE-2019-20372 page Image SLES15-SP1-CAP-Deployment-BYOS-EC2-HVM Image SLES15-SP1-CAP-Deployment-BYOS-GCE SUSE Linux Enterprise Module for Server Applications 15 SP1 nginx-1.14.2-6.7.1 nginx-source-1.14.2-6.7.1 vim-plugin-nginx-1.14.2-6.7.1 nginx-1.14.2-6.7.1 as a component of Image SLES15-SP1-CAP-Deployment-BYOS-EC2-HVM nginx-1.14.2-6.7.1 as a component of Image SLES15-SP1-CAP-Deployment-BYOS-GCE nginx-1.14.2-6.7.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP1 nginx-source-1.14.2-6.7.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP1 NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer. CVE-2019-20372 Image SLES15-SP1-CAP-Deployment-BYOS-EC2-HVM:nginx-1.14.2-6.7.1 Image SLES15-SP1-CAP-Deployment-BYOS-GCE:nginx-1.14.2-6.7.1 SUSE Linux Enterprise Module for Server Applications 15 SP1:nginx-1.14.2-6.7.1 SUSE Linux Enterprise Module for Server Applications 15 SP1:nginx-source-1.14.2-6.7.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2020/suse-su-20200348-1/ https://www.suse.com/security/cve/CVE-2019-20372.html CVE-2019-20372 https://bugzilla.suse.com/1160682 SUSE Bug 1160682