ALASNGINX1-2024-007

Amazon Linux 2 Security Advisory: ALASNGINX1-2024-007
Advisory Release Date: 2024-08-28 19:02 Pacific
Advisory Updated Date: 2024-09-05 13:50 Pacific
Severity: Medium
Issue Overview:

NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with the ngx_http_mp4_module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted mp4 file with the ngx_http_mp4_module. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. (CVE-2024-7347)


Affected Packages:

nginx


Note:

This advisory is applicable to Amazon Linux 2 - Nginx1 Extra. Visit this page to learn more about Amazon Linux 2 (AL2) Extras and this FAQ section for the difference between AL2 Core and AL2 Extras advisories.


Issue Correction:
Run yum update nginx to update your system.

New Packages:
aarch64:
    nginx-1.22.1-1.amzn2.0.4.aarch64
    nginx-core-1.22.1-1.amzn2.0.4.aarch64
    nginx-mod-http-geoip-1.22.1-1.amzn2.0.4.aarch64
    nginx-mod-http-image-filter-1.22.1-1.amzn2.0.4.aarch64
    nginx-mod-http-perl-1.22.1-1.amzn2.0.4.aarch64
    nginx-mod-http-xslt-filter-1.22.1-1.amzn2.0.4.aarch64
    nginx-mod-mail-1.22.1-1.amzn2.0.4.aarch64
    nginx-mod-stream-1.22.1-1.amzn2.0.4.aarch64
    nginx-mod-devel-1.22.1-1.amzn2.0.4.aarch64
    nginx-debuginfo-1.22.1-1.amzn2.0.4.aarch64

noarch:
    nginx-all-modules-1.22.1-1.amzn2.0.4.noarch
    nginx-filesystem-1.22.1-1.amzn2.0.4.noarch

src:
    nginx-1.22.1-1.amzn2.0.4.src

x86_64:
    nginx-1.22.1-1.amzn2.0.4.x86_64
    nginx-core-1.22.1-1.amzn2.0.4.x86_64
    nginx-mod-http-geoip-1.22.1-1.amzn2.0.4.x86_64
    nginx-mod-http-image-filter-1.22.1-1.amzn2.0.4.x86_64
    nginx-mod-http-perl-1.22.1-1.amzn2.0.4.x86_64
    nginx-mod-http-xslt-filter-1.22.1-1.amzn2.0.4.x86_64
    nginx-mod-mail-1.22.1-1.amzn2.0.4.x86_64
    nginx-mod-stream-1.22.1-1.amzn2.0.4.x86_64
    nginx-mod-devel-1.22.1-1.amzn2.0.4.x86_64
    nginx-debuginfo-1.22.1-1.amzn2.0.4.x86_64

Additional References

Red Hat: CVE-2024-7347

Mitre: CVE-2024-7347