Amazon Linux 2 Security Advisory: ALASNGINX1-2023-005
Advisory Release Date: 2023-08-07 06:17 Pacific
Advisory Updated Date: 2023-09-25 22:08 Pacific
The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubuntu0.16.04.3 on Ubuntu 16.04 LTS, and before 1.10.1-0ubuntu1.1 on Ubuntu 16.10, and the nginx ebuild before 1.10.2-r3 on Gentoo allow local users with access to the web server user account to gain root privileges via a symlink attack on the error log. (CVE-2016-1247)
Affected Packages:
nginx
Note:
This advisory is applicable to Amazon Linux 2 - Nginx1 Extra. Visit this page to learn more about Amazon Linux 2 (AL2) Extras and this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update nginx to update your system.
aarch64:
nginx-1.20.0-2.amzn2.0.1.aarch64
nginx-mod-http-geoip-1.20.0-2.amzn2.0.1.aarch64
nginx-mod-http-image-filter-1.20.0-2.amzn2.0.1.aarch64
nginx-mod-http-perl-1.20.0-2.amzn2.0.1.aarch64
nginx-mod-http-xslt-filter-1.20.0-2.amzn2.0.1.aarch64
nginx-mod-mail-1.20.0-2.amzn2.0.1.aarch64
nginx-mod-stream-1.20.0-2.amzn2.0.1.aarch64
nginx-debuginfo-1.20.0-2.amzn2.0.1.aarch64
noarch:
nginx-all-modules-1.20.0-2.amzn2.0.1.noarch
nginx-filesystem-1.20.0-2.amzn2.0.1.noarch
src:
nginx-1.20.0-2.amzn2.0.1.src
x86_64:
nginx-1.20.0-2.amzn2.0.1.x86_64
nginx-mod-http-geoip-1.20.0-2.amzn2.0.1.x86_64
nginx-mod-http-image-filter-1.20.0-2.amzn2.0.1.x86_64
nginx-mod-http-perl-1.20.0-2.amzn2.0.1.x86_64
nginx-mod-http-xslt-filter-1.20.0-2.amzn2.0.1.x86_64
nginx-mod-mail-1.20.0-2.amzn2.0.1.x86_64
nginx-mod-stream-1.20.0-2.amzn2.0.1.x86_64
nginx-debuginfo-1.20.0-2.amzn2.0.1.x86_64