USN-7014-1: nginx vulnerability

Releases

• Ubuntu 24.04 LTS
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS

Packages

• nginx - small, powerful, scalable web/proxy server

Details

It was discovered that the nginx ngx_http_mp4 module incorrectly handled
certain malformed mp4 files. In environments where the mp4 directive is in
use, a remote attacker could possibly use this issue to cause nginx to
crash, resulting in a denial of service.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 24.04

• nginx - 1.24.0-2ubuntu7.1
• nginx-common - 1.24.0-2ubuntu7.1
• nginx-core - 1.24.0-2ubuntu7.1
• nginx-extras - 1.24.0-2ubuntu7.1
• nginx-full - 1.24.0-2ubuntu7.1
• nginx-light - 1.24.0-2ubuntu7.1

Ubuntu 22.04

• nginx - 1.18.0-6ubuntu14.5
• nginx-common - 1.18.0-6ubuntu14.5
• nginx-core - 1.18.0-6ubuntu14.5
• nginx-extras - 1.18.0-6ubuntu14.5
• nginx-full - 1.18.0-6ubuntu14.5
• nginx-light - 1.18.0-6ubuntu14.5

Ubuntu 20.04

• nginx - 1.18.0-0ubuntu1.6
• nginx-common - 1.18.0-0ubuntu1.6
• nginx-core - 1.18.0-0ubuntu1.6
• nginx-extras - 1.18.0-0ubuntu1.6
• nginx-full - 1.18.0-0ubuntu1.6
• nginx-light - 1.18.0-0ubuntu1.6

In general, a standard system update will make all the necessary changes.

References

• CVE-2024-7347

Related notices

• USN-7014-2
• USN-7014-3