Amazon Linux 1 Security Advisory: ALAS-2013-189
Advisory Release Date: 2013-05-14 15:35 Pacific
Advisory Updated Date: 2014-09-15 23:31 Pacific
Severity:
Medium
Issue Overview:
http/modules/ngx_http_proxy_module.c in nginx 1.1.4 through 1.2.8 and 1.3.0 through 1.4.0, when proxy_pass is used with untrusted HTTP servers, allows remote attackers to cause a denial of service (crash) and obtain sensitive information from worker process memory via a crafted proxy response, a similar vulnerability to CVE-2013-2028.
Affected Packages:
nginx
Issue Correction:
Run yum update nginx to update your system.
New Packages:
i686:
nginx-debuginfo-1.2.9-1.11.amzn1.i686
nginx-1.2.9-1.11.amzn1.i686
src:
nginx-1.2.9-1.11.amzn1.src
x86_64:
nginx-1.2.9-1.11.amzn1.x86_64
nginx-debuginfo-1.2.9-1.11.amzn1.x86_64