Уведомление безопасности usn-4967-1

Высокая (6.8)

(AV:N/AC:M/Au:N/C:P/I:P/A:P)

Canonical Ubuntu

nginx (any) nginx-common (any) nginx-core (any) nginx-extras (any) nginx-full (any) nginx-light (any)

nginx could be made to crash or run programs if it received specially
crafted network traffic.
Luis Merino, Markus Vervier, and Eric Sesterhenn discovered that nginx
incorrectly handled responses to the DNS resolver. A remote attacker could
use this issue to cause nginx to crash, resulting in a denial of service,
or possibly execute arbitrary code.

Проблема может быть решена обновлением операционной системы до следующих версий пакетов:
Ubuntu 18.04 LTS:
nginx - 1.14.0-0ubuntu1.9
nginx-common - 1.14.0-0ubuntu1.9
nginx-core - 1.14.0-0ubuntu1.9
nginx-extras - 1.14.0-0ubuntu1.9
nginx-full - 1.14.0-0ubuntu1.9
nginx-light - 1.14.0-0ubuntu1.9
Ubuntu 20.04 LTS:
nginx - 1.18.0-0ubuntu1.2
nginx-common - 1.18.0-0ubuntu1.2
nginx-core - 1.18.0-0ubuntu1.2
nginx-extras - 1.18.0-0ubuntu1.2
nginx-full - 1.18.0-0ubuntu1.2
nginx-light - 1.18.0-0ubuntu1.2
Ubuntu 20.10 :
nginx - 1.18.0-6ubuntu2.2
nginx-common - 1.18.0-6ubuntu2.2
nginx-core - 1.18.0-6ubuntu2.2
nginx-extras - 1.18.0-6ubuntu2.2
nginx-full - 1.18.0-6ubuntu2.2
nginx-light - 1.18.0-6ubuntu2.2
Ubuntu 21.04 :
nginx - 1.18.0-6ubuntu8.2
nginx-common - 1.18.0-6ubuntu8.2
nginx-core - 1.18.0-6ubuntu8.2
nginx-extras - 1.18.0-6ubuntu8.2
nginx-full - 1.18.0-6ubuntu8.2
nginx-light - 1.18.0-6ubuntu8.2

Источник: CVE
Наименование: CVE-2021-23017
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23017

https://ubuntu.com/security/notices/USN-4967-1