Amazon Linux 2023 Security Advisory: ALAS-2024-707
Advisory Release Date: 2024-08-28 20:03 Pacific
Advisory Updated Date: 2024-09-04 12:40 Pacific
Severity:
Medium
Issue Overview:
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module, which might allow an attacker to over-read NGINX worker memory resulting in its termination, using a specially crafted mp4 file. The issue only affects NGINX if it is built with the ngx_http_mp4_module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted mp4 file with the ngx_http_mp4_module. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. (CVE-2024-7347)
Affected Packages:
nginx
Issue Correction:
Run dnf update nginx --releasever 2023.5.20240903 to update your system.
New Packages:
aarch64:
nginx-debuginfo-1.24.0-1.amzn2023.0.3.aarch64
nginx-mod-http-image-filter-1.24.0-1.amzn2023.0.3.aarch64
nginx-core-debuginfo-1.24.0-1.amzn2023.0.3.aarch64
nginx-mod-mail-1.24.0-1.amzn2023.0.3.aarch64
nginx-mod-stream-debuginfo-1.24.0-1.amzn2023.0.3.aarch64
nginx-mod-http-perl-debuginfo-1.24.0-1.amzn2023.0.3.aarch64
nginx-mod-http-perl-1.24.0-1.amzn2023.0.3.aarch64
nginx-1.24.0-1.amzn2023.0.3.aarch64
nginx-mod-http-xslt-filter-1.24.0-1.amzn2023.0.3.aarch64
nginx-mod-http-xslt-filter-debuginfo-1.24.0-1.amzn2023.0.3.aarch64
nginx-mod-mail-debuginfo-1.24.0-1.amzn2023.0.3.aarch64
nginx-mod-devel-1.24.0-1.amzn2023.0.3.aarch64
nginx-mod-http-image-filter-debuginfo-1.24.0-1.amzn2023.0.3.aarch64
nginx-core-1.24.0-1.amzn2023.0.3.aarch64
nginx-mod-stream-1.24.0-1.amzn2023.0.3.aarch64
nginx-debugsource-1.24.0-1.amzn2023.0.3.aarch64
noarch:
nginx-all-modules-1.24.0-1.amzn2023.0.3.noarch
nginx-filesystem-1.24.0-1.amzn2023.0.3.noarch
src:
nginx-1.24.0-1.amzn2023.0.3.src
x86_64:
nginx-debuginfo-1.24.0-1.amzn2023.0.3.x86_64
nginx-mod-http-image-filter-1.24.0-1.amzn2023.0.3.x86_64
nginx-mod-http-image-filter-debuginfo-1.24.0-1.amzn2023.0.3.x86_64
nginx-mod-http-perl-1.24.0-1.amzn2023.0.3.x86_64
nginx-core-1.24.0-1.amzn2023.0.3.x86_64
nginx-mod-mail-debuginfo-1.24.0-1.amzn2023.0.3.x86_64
nginx-debugsource-1.24.0-1.amzn2023.0.3.x86_64
nginx-mod-http-perl-debuginfo-1.24.0-1.amzn2023.0.3.x86_64
nginx-mod-devel-1.24.0-1.amzn2023.0.3.x86_64
nginx-1.24.0-1.amzn2023.0.3.x86_64
nginx-mod-http-xslt-filter-1.24.0-1.amzn2023.0.3.x86_64
nginx-mod-stream-1.24.0-1.amzn2023.0.3.x86_64
nginx-core-debuginfo-1.24.0-1.amzn2023.0.3.x86_64
nginx-mod-stream-debuginfo-1.24.0-1.amzn2023.0.3.x86_64
nginx-mod-mail-1.24.0-1.amzn2023.0.3.x86_64
nginx-mod-http-xslt-filter-debuginfo-1.24.0-1.amzn2023.0.3.x86_64