Bug 624552 – <www-servers/nginx-{1.12.1,1.13.3}: integer overflow in range filter (CVE-2017-7529)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description GLSAMaker/CVETool Bot 2017-07-11 16:09:40 UTC]

CVE-2017-7529 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-7529):
  A security issue was identified in nginx range filter. A specially crafted
  request might result in an integer overflow and incorrect processing of
  ranges, potentially resulting in sensitive information leak.


When using nginx with standard modules this allows an attacker to
obtain a cache file header if a response was returned from cache.
In some configurations a cache file header may contain IP address
of the backend server or other sensitive information.

Besides, with 3rd party modules it is potentially possible that
the issue may lead to a denial of service or a disclosure of
a worker process memory.  No such modules are currently known though.

The issue affects nginx 0.5.6 - 1.13.2.
The issue is fixed in nginx 1.13.3, 1.12.1.

For older versions, the following configuration can be used
as a temporary workaround:

    max_ranges 1;

Patch for the issue can be found here:

http://nginx.org/download/patch.2017.ranges.txt

[Comment 1 Thomas Deutschmann (RETIRED) 2017-07-11 16:33:27 UTC]

Now in repository via https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d195ea6ec9933d558fecdfb30edebca2ea413c13


@ Arches,

please test and mark stable: =www-servers/nginx-1.12.1

[Comment 2 Agostino Sarubbo 2017-07-12 08:18:03 UTC]

amd64 stable

[Comment 3 Agostino Sarubbo 2017-07-12 08:18:53 UTC]

x86 stable.

Maintainer(s), please cleanup.
Security, please vote.

[Comment 4 Thomas Deutschmann (RETIRED) 2017-07-12 10:35:52 UTC]

Repository is now clean: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a10dc685fb4d5ab1d8f0ed6a5e6a0ec536552ace

[Comment 5 Aaron Bauman (RETIRED) 2017-07-15 22:20:28 UTC]

GLSA Vote: No