nginx vulnerability

[Maxim Dounin]

Hello!

On Thu, Nov 19, 2020 at 02:06:46PM -0800, Frank Liu wrote:

> CVE-2019-20372 mentioned a security vulnerability, but I don't see it in
> http://nginx.org/en/security_advisories.html
> Does that mean CVE-2019-20372 is not considered a security vulnerability by
> nginx? Or is it because nginx standard config won't be vulnerable, and
> users have to enable error_log in order to be vulnerable?

The CVE-2019-20372 corresponds to the following bugfix in nginx 
1.17.7:

    *) Bugfix: requests with bodies were handled incorrectly when returning
       redirections with the "error_page" directive; the bug had appeared in
       0.7.12.

It only affects rarely used configurations with error_page 
returning redirects by itself, that is, configurations with 
"error_page ... http://...".  Further, it can only have any 
security impact if nginx is used behind another HTTP proxy, and 
the configuration relies on security checks on this proxy.

Given the above, it is not considered to be a security issue, but 
rather treated as a bug.  This bug is already fixed in all 
supported nginx versions.

-- 
Maxim Dounin
http://mdounin.ru/