svn commit: r525646 - head/security/vuxml

Sun Feb 9 11:10:36 UTC 2020

Author: joneum
Date: Sun Feb  9 11:10:36 2020
New Revision: 525646
URL: https://svnweb.freebsd.org/changeset/ports/525646

Log:
  Add entry for nginx
  
  PR:		243952
  Sponsored by:	Netzkommune GmbH

Modified:
  head/security/vuxml/vuln.xml

Modified: head/security/vuxml/vuln.xml
==============================================================================

--- head/security/vuxml/vuln.xml	Sun Feb  9 11:09:56 2020	(r525645)
+++ head/security/vuxml/vuln.xml	Sun Feb  9 11:10:36 2020	(r525646)
@@ -58,6 +58,39 @@ Notes:
   * Do not forget port variants (linux-f10-libxml2, libxml2, etc.)
 -->
 <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+  <vuln vid="c1202de8-4b29-11ea-9673-4c72b94353b5">
+    <topic>NGINX -- HTTP request smuggling</topic>
+    <affects>
+      <package>
+	<name>nginx</name>
+	<range><lt>1.16.10,2</lt></range>
+      </package>
+      <package>
+	<name>nginx-devel</name>
+	<range><lt>1.17.6</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+	<p>NGINX Team reports:</p>
+	<blockquote cite="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20372">
+	  <p>NGINX before 1.17.7, with certain error_page configurations, allows HTTP
+	    request smuggling, as demonstrated by the ability of an attacker to read
+	    unauthorized web pages in environments where NGINX is being fronted by a
+	    load balancer.</p>
+	</blockquote>
+      </body>
+    </description>
+    <references>
+      <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20372</url>
+      <cvename>CVE-2019-20372</cvename>
+    </references>
+    <dates>
+      <discovery>2019-12-10</discovery>
+      <entry>2020-02-09</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="8b20d716-49df-11ea-9f7b-206a8a720317">
     <topic>ksh93 -- certain environment variables interpreted as arithmetic expressions on startup, leading to code injection</topic>
     <affects>
