USN-7014-1: nginx vulnerability

Releases

• Ubuntu 24.04 LTS
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS

Packages

• nginx - small, powerful, scalable web/proxy server

Details

It was discovered that the nginx ngx_http_mp4 module incorrectly handled
certain malformed mp4 files. In environments where the mp4 directive is in
use, a remote attacker could possibly use this issue to cause nginx to
crash, resulting in a denial of service.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 24.04

• nginx - 1.24.0-2ubuntu7.1
• nginx-common - 1.24.0-2ubuntu7.1
• nginx-core - 1.24.0-2ubuntu7.1
• nginx-extras - 1.24.0-2ubuntu7.1
• nginx-full - 1.24.0-2ubuntu7.1
• nginx-light - 1.24.0-2ubuntu7.1

Ubuntu 22.04

• nginx - 1.18.0-6ubuntu14.5
• nginx-common - 1.18.0-6ubuntu14.5
• nginx-core - 1.18.0-6ubuntu14.5
• nginx-extras - 1.18.0-6ubuntu14.5
• nginx-full - 1.18.0-6ubuntu14.5
• nginx-light - 1.18.0-6ubuntu14.5

Ubuntu 20.04

• nginx - 1.18.0-0ubuntu1.6
• nginx-common - 1.18.0-0ubuntu1.6
• nginx-core - 1.18.0-0ubuntu1.6
• nginx-extras - 1.18.0-0ubuntu1.6
• nginx-full - 1.18.0-0ubuntu1.6
• nginx-light - 1.18.0-0ubuntu1.6

In general, a standard system update will make all the necessary changes.

References

• CVE-2024-7347

Related notices

• USN-7014-2: nginx-full, libnginx-mod-http-upstream-fair, libnginx-mod-http-headers-more-filter, libnginx-mod-http-perl, nginx, nginx-doc, nginx-light, libnginx-mod-http-fancyindex, libnginx-mod-http-uploadprogress, libnginx-mod-http-geoip, libnginx-mod-stream, libnginx-mod-http-image-filter, libnginx-mod-http-ndk, libnginx-mod-nchan, libnginx-mod-rtmp, libnginx-mod-http-echo, libnginx-mod-http-dav-ext, nginx-core, nginx-extras, libnginx-mod-http-auth-pam, libnginx-mod-mail, libnginx-mod-http-cache-purge, libnginx-mod-http-subs-filter, libnginx-mod-http-lua, nginx-common, libnginx-mod-http-xslt-filter
• USN-7014-3: nginx-full, nginx-core, nginx, nginx-extras, nginx-naxsi-ui, nginx-common, nginx-doc, nginx-light, nginx-naxsi