CVE-2019-20372
Fixed in a distro release EPSS 15%
NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.
Products: f5 nginx, apple xcode, canonical ubuntu_linux, opensuse leap, netapp cloud_backup
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | nginx | 1.16.1-r2 |
| Alpine 3.11 | nginx | 1.16.1-r6 |
| Alpine 3.12 | nginx | 1.16.1-r6 |
| Alpine 3.13 | nginx | 1.16.1-r6 |
| Alpine 3.14 | nginx | 1.16.1-r6 |
| Alpine 3.15 | nginx | 1.16.1-r6 |
| Alpine 3.16 | nginx | 1.16.1-r6 |
| Alpine 3.17 | nginx | 1.16.1-r6 |
| Alpine 3.18 | nginx | 1.16.1-r6 |
| Alpine 3.19 | nginx | 1.16.1-r6 |
| Alpine 3.20 | nginx | 1.16.1-r6 |
| Alpine 3.21 | nginx | 1.16.1-r6 |
| Alpine 3.22 | nginx | 1.16.1-r6 |
| Alpine 3.23 | nginx | 1.16.1-r6 |
| Alpine 3.24 | nginx | 1.16.1-r6 |
| Alpine 3.8 | nginx | 1.14.2-r2 |
| Alpine 3.9 | nginx | 1.14.2-r5 |
| Debian 12 | nginx | 1.16.1-3 |
| Debian 13 | nginx | 1.16.1-3 |
| Debian 14 | nginx | 1.16.1-3 |
| Red Hat Enterprise Linux 8 | nginx | 1:1.16.1-1.module+el8.3.0+8844+e5e7039f.1 |
| Red Hat Enterprise Linux 8 | nginx-all-modules | 1:1.16.1-1.module+el8.3.0+8844+e5e7039f.1 |
| Red Hat Enterprise Linux 8 | nginx-debuginfo | 1:1.16.1-1.module+el8.3.0+8844+e5e7039f.1 |
| Red Hat Enterprise Linux 8 | nginx-debugsource | 1:1.16.1-1.module+el8.3.0+8844+e5e7039f.1 |
| Red Hat Enterprise Linux 8 | nginx-filesystem | 1:1.16.1-1.module+el8.3.0+8844+e5e7039f.1 |
| Red Hat Enterprise Linux 8 | nginx-mod-http-image-filter | 1:1.16.1-1.module+el8.3.0+8844+e5e7039f.1 |
| Red Hat Enterprise Linux 8 | nginx-mod-http-image-filter-debuginfo | 1:1.16.1-1.module+el8.3.0+8844+e5e7039f.1 |
| Red Hat Enterprise Linux 8 | nginx-mod-http-perl | 1:1.16.1-1.module+el8.3.0+8844+e5e7039f.1 |
| Red Hat Enterprise Linux 8 | nginx-mod-http-perl-debuginfo | 1:1.16.1-1.module+el8.3.0+8844+e5e7039f.1 |
| Red Hat Enterprise Linux 8 | nginx-mod-http-xslt-filter | 1:1.16.1-1.module+el8.3.0+8844+e5e7039f.1 |
| Red Hat Enterprise Linux 8 | nginx-mod-http-xslt-filter-debuginfo | 1:1.16.1-1.module+el8.3.0+8844+e5e7039f.1 |
| Red Hat Enterprise Linux 8 | nginx-mod-mail | 1:1.16.1-1.module+el8.3.0+8844+e5e7039f.1 |
| Red Hat Enterprise Linux 8 | nginx-mod-mail-debuginfo | 1:1.16.1-1.module+el8.3.0+8844+e5e7039f.1 |
| Red Hat Enterprise Linux 8 | nginx-mod-stream | 1:1.16.1-1.module+el8.3.0+8844+e5e7039f.1 |
| Red Hat Enterprise Linux 8 | nginx-mod-stream-debuginfo | 1:1.16.1-1.module+el8.3.0+8844+e5e7039f.1 |
| Red Hat rhel software collections 3 | rh-nginx116-nginx | 1:1.16.1-4.el7.1 |
| Red Hat rhel software collections 3 | rh-nginx116-nginx-debuginfo | 1:1.16.1-4.el7.1 |
| Red Hat rhel software collections 3 | rh-nginx116-nginx-mod-http-image-filter | 1:1.16.1-4.el7.1 |
| Red Hat rhel software collections 3 | rh-nginx116-nginx-mod-http-perl | 1:1.16.1-4.el7.1 |
| Red Hat rhel software collections 3 | rh-nginx116-nginx-mod-http-xslt-filter | 1:1.16.1-4.el7.1 |
| Red Hat rhel software collections 3 | rh-nginx116-nginx-mod-mail | 1:1.16.1-4.el7.1 |
| Red Hat rhel software collections 3 | rh-nginx116-nginx-mod-stream | 1:1.16.1-4.el7.1 |
| SUSE Linux Enterprise High Performance Computing 15-ESPOS | nginx | 1.16.1-3.12.7 |
| SUSE Linux Enterprise High Performance Computing 15-LTSS | nginx | 1.16.1-3.12.7 |
| SUSE Linux Enterprise Module for Server Applications 15 SP1 | nginx | 1.14.2-6.7.1 |
| SUSE Linux Enterprise Server 15-LTSS | nginx | 1.16.1-3.12.7 |
| SUSE Linux Enterprise Server for SAP Applications 15 | nginx | 1.16.1-3.12.7 |
| Ubuntu 16.04 LTS | nginx | 1.10.3-0ubuntu0.16.04.5 |
| Ubuntu 18.04 LTS | nginx | 1.14.0-0ubuntu1.7 |
| Ubuntu Pro 14.04 LTS | nginx | 1.4.6-1ubuntu3.9+esm1 |
| openSUSE Leap 15.1 | nginx | 1.14.2-lp151.4.6.1 |
| openSUSE Tumbleweed | nginx | 1.21.3-1.4 |