Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 624552 (CVE-2017-7529)

Summary: <www-servers/nginx-{1.12.1,1.13.3}: integer overflow in range filter (CVE-2017-7529)
Product: Gentoo Security Reporter: GLSAMaker/CVETool Bot <glsamaker>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Severity: minor CC: bugs, dev-zero, whissi
Priority: Normal Flags: stable-bot: sanity-check+
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: B3 [noglsa cve]
Package list:
Runtime testing required: ---

Description GLSAMaker/CVETool Bot gentoo-dev 2017-07-11 16:09:40 UTC
CVE-2017-7529 (
  A security issue was identified in nginx range filter. A specially crafted
  request might result in an integer overflow and incorrect processing of
  ranges, potentially resulting in sensitive information leak.

When using nginx with standard modules this allows an attacker to
obtain a cache file header if a response was returned from cache.
In some configurations a cache file header may contain IP address
of the backend server or other sensitive information.

Besides, with 3rd party modules it is potentially possible that
the issue may lead to a denial of service or a disclosure of
a worker process memory.  No such modules are currently known though.

The issue affects nginx 0.5.6 - 1.13.2.
The issue is fixed in nginx 1.13.3, 1.12.1.

For older versions, the following configuration can be used
as a temporary workaround:

    max_ranges 1;

Patch for the issue can be found here:
Comment 1 Thomas Deutschmann (RETIRED) gentoo-dev 2017-07-11 16:33:27 UTC
Now in repository via

@ Arches,

please test and mark stable: =www-servers/nginx-1.12.1
Comment 2 Agostino Sarubbo gentoo-dev 2017-07-12 08:18:03 UTC
amd64 stable
Comment 3 Agostino Sarubbo gentoo-dev 2017-07-12 08:18:53 UTC
x86 stable.

Maintainer(s), please cleanup.
Security, please vote.
Comment 4 Thomas Deutschmann (RETIRED) gentoo-dev 2017-07-12 10:35:52 UTC
Repository is now clean:
Comment 5 Aaron Bauman (RETIRED) gentoo-dev 2017-07-15 22:20:28 UTC
GLSA Vote: No