Red Hat Security Advisory

RHSA-2018:3680

rh-nginx112-nginx security update

Released 2018-11-27 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nginx112-nginx-1:1.12.1-2.el7.1, rh-nginx112-nginx-mod-http-image-filter-1:1.12.1-2.el7.1, rh-nginx112-nginx-mod-http-perl-1:1.12.1-2.el7.1 +3
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-nginx112-nginx-1:1.12.1-2.el7.1, rh-nginx112-nginx-mod-http-image-filter-1:1.12.1-2.el7.1, rh-nginx112-nginx-mod-http-perl-1:1.12.1-2.el7.1 +3
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-nginx112-nginx-1:1.12.1-2.el7.1, rh-nginx112-nginx-mod-http-image-filter-1:1.12.1-2.el7.1, rh-nginx112-nginx-mod-http-perl-1:1.12.1-2.el7.1 +3
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nginx112-nginx-1:1.12.1-2.el7.1, rh-nginx112-nginx-mod-http-image-filter-1:1.12.1-2.el7.1, rh-nginx112-nginx-mod-http-perl-1:1.12.1-2.el7.1 +3
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nginx112-nginx-1:1.12.1-2.el7.1, rh-nginx112-nginx-mod-http-image-filter-1:1.12.1-2.el7.1, rh-nginx112-nginx-mod-http-perl-1:1.12.1-2.el7.1 +3

Fixes 3 records

TI-2018-12053 CVE-2018-16843 · GHSA-4p62-4q7w-qmcg

Uncontrolled resource consumption in [UNKNOWN] nginx

MEDIUM 63

nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.47985 Published 2018-11-07 Fixed CWE-400

TI-2018-12054 CVE-2018-16844 · GHSA-4576-cf38-77f2

Uncontrolled resource consumption in [UNKNOWN] nginx

MEDIUM 47

nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive CPU usage.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.12733 Published 2018-11-07 Partial fix CWE-400

TI-2018-12055 CVE-2018-16845 · GHSA-vq5f-vpgw-9vcp

Uncontrolled resource consumption in [UNKNOWN] nginx

LOW 39

nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_module, which might allow an attacker to cause infinite loop in a worker process, cause a worker process crash, or might result in worker proce…

CVSS 3.1MEDIUM 6.1 Local No auth User interaction EPSS 0.09845 Published 2018-11-07 Fixed CWE-400