Vulnerabilities > CVE-2019-20372 - HTTP Request Smuggling vulnerability in multiple products

CVSS 5.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

LOW

Integrity impact

NONE

Availability impact

NONE

network

low complexity

nessus

NVD

Published: 2020-01-09

Updated: 2022-04-06

Summary

NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.

Vulnerable Configurations

Part	Description	Count
Application	F5 F5 Nginx - F5 Nginx 0.1.0 F5 Nginx 0.1.1 F5 Nginx 0.1.2 F5 Nginx 0.1.3 F5 Nginx 0.1.4 F5 Nginx 0.1.5 F5 Nginx 0.1.6 F5 Nginx 0.1.7 F5 Nginx 0.1.8 F5 Nginx 0.1.9 F5 Nginx 0.1.10 F5 Nginx 0.1.11 F5 Nginx 0.1.12 F5 Nginx 0.1.13 F5 Nginx 0.1.14 F5 Nginx 0.1.15 F5 Nginx 0.1.16 F5 Nginx 0.1.17 F5 Nginx 0.1.18 F5 Nginx 0.1.19 F5 Nginx 0.1.20 F5 Nginx 0.1.21 F5 Nginx 0.1.22 F5 Nginx 0.1.23 F5 Nginx 0.1.24 F5 Nginx 0.1.25 F5 Nginx 0.1.26 F5 Nginx 0.1.27 F5 Nginx 0.1.28 F5 Nginx 0.1.29 F5 Nginx 0.1.30 F5 Nginx 0.1.31 F5 Nginx 0.1.32 F5 Nginx 0.1.33 F5 Nginx 0.1.34 F5 Nginx 0.1.35 F5 Nginx 0.1.36 F5 Nginx 0.1.37 F5 Nginx 0.1.38 F5 Nginx 0.1.39 F5 Nginx 0.1.40 F5 Nginx 0.1.41 F5 Nginx 0.1.42 F5 Nginx 0.1.43 F5 Nginx 0.1.44 F5 Nginx 0.1.45 F5 Nginx 0.2.0 F5 Nginx 0.2.1 F5 Nginx 0.2.2 F5 Nginx 0.2.3 F5 Nginx 0.2.4 F5 Nginx 0.2.5 F5 Nginx 0.2.6 F5 Nginx 0.3.0 F5 Nginx 0.3.1 F5 Nginx 0.3.2 F5 Nginx 0.3.3 F5 Nginx 0.3.4 F5 Nginx 0.3.5 F5 Nginx 0.3.6 F5 Nginx 0.3.7 F5 Nginx 0.3.8 F5 Nginx 0.3.9 F5 Nginx 0.3.10 F5 Nginx 0.3.11 F5 Nginx 0.3.12 F5 Nginx 0.3.13 F5 Nginx 0.3.14 F5 Nginx 0.3.15 F5 Nginx 0.3.16 F5 Nginx 0.3.17 F5 Nginx 0.3.18 F5 Nginx 0.3.19 F5 Nginx 0.3.20 F5 Nginx 0.3.21 F5 Nginx 0.3.22 F5 Nginx 0.3.23 F5 Nginx 0.3.24 F5 Nginx 0.3.25 F5 Nginx 0.3.26 F5 Nginx 0.3.27 F5 Nginx 0.3.28 F5 Nginx 0.3.29 F5 Nginx 0.3.30 F5 Nginx 0.3.31 F5 Nginx 0.3.32 F5 Nginx 0.3.33 F5 Nginx 0.3.34 F5 Nginx 0.3.35 F5 Nginx 0.3.36 F5 Nginx 0.3.37 F5 Nginx 0.3.38 F5 Nginx 0.3.39 F5 Nginx 0.3.40 F5 Nginx 0.3.41 F5 Nginx 0.3.42 F5 Nginx 0.3.43 F5 Nginx 0.3.44 F5 Nginx 0.3.45 F5 Nginx 0.3.46 F5 Nginx 0.3.47 F5 Nginx 0.3.48 F5 Nginx 0.3.49 F5 Nginx 0.3.50 F5 Nginx 0.3.51 F5 Nginx 0.3.52 F5 Nginx 0.3.53 F5 Nginx 0.3.54 F5 Nginx 0.3.55 F5 Nginx 0.3.56 F5 Nginx 0.3.57 F5 Nginx 0.3.58 F5 Nginx 0.3.59 F5 Nginx 0.3.60 F5 Nginx 0.3.61 F5 Nginx 0.4.0 F5 Nginx 0.4.1 F5 Nginx 0.4.2 F5 Nginx 0.4.3 F5 Nginx 0.4.4 F5 Nginx 0.4.5 F5 Nginx 0.4.6 F5 Nginx 0.4.7 F5 Nginx 0.4.8 F5 Nginx 0.4.9 F5 Nginx 0.4.10 F5 Nginx 0.4.11 F5 Nginx 0.4.12 F5 Nginx 0.4.13 F5 Nginx 0.4.14 F5 Nginx 0.5.0 F5 Nginx 0.5.1 F5 Nginx 0.5.2 F5 Nginx 0.5.3 F5 Nginx 0.5.4 F5 Nginx 0.5.5 F5 Nginx 0.5.6 F5 Nginx 0.5.7 F5 Nginx 0.5.8 F5 Nginx 0.5.9 F5 Nginx 0.5.10 F5 Nginx 0.5.11 F5 Nginx 0.5.12 F5 Nginx 0.5.13 F5 Nginx 0.5.14 F5 Nginx 0.5.15 F5 Nginx 0.5.16 F5 Nginx 0.5.17 F5 Nginx 0.5.18 F5 Nginx 0.5.19 F5 Nginx 0.5.20 F5 Nginx 0.5.21 F5 Nginx 0.5.22 F5 Nginx 0.5.23 F5 Nginx 0.5.24 F5 Nginx 0.5.25 F5 Nginx 0.5.26 F5 Nginx 0.5.27 F5 Nginx 0.5.28 F5 Nginx 0.5.29 F5 Nginx 0.5.30 F5 Nginx 0.5.31 F5 Nginx 0.5.32 F5 Nginx 0.5.33 F5 Nginx 0.5.34 F5 Nginx 0.5.35 F5 Nginx 0.5.36 F5 Nginx 0.5.37 F5 Nginx 0.5.38 F5 Nginx 0.6.0 F5 Nginx 0.6.1 F5 Nginx 0.6.2 F5 Nginx 0.6.3 F5 Nginx 0.6.4 F5 Nginx 0.6.5 F5 Nginx 0.6.6 F5 Nginx 0.6.7 F5 Nginx 0.6.8 F5 Nginx 0.6.9 F5 Nginx 0.6.10 F5 Nginx 0.6.11 F5 Nginx 0.6.12 F5 Nginx 0.6.13 F5 Nginx 0.6.14 F5 Nginx 0.6.15 F5 Nginx 0.6.16 F5 Nginx 0.6.17 F5 Nginx 0.6.18 F5 Nginx 0.6.19 F5 Nginx 0.6.20 F5 Nginx 0.6.21 F5 Nginx 0.6.22 F5 Nginx 0.6.23 F5 Nginx 0.6.24 F5 Nginx 0.6.25 F5 Nginx 0.6.26 F5 Nginx 0.6.27 F5 Nginx 0.6.28 F5 Nginx 0.6.29 F5 Nginx 0.6.30 F5 Nginx 0.6.31 F5 Nginx 0.6.32 F5 Nginx 0.6.33 F5 Nginx 0.6.34 F5 Nginx 0.6.35 F5 Nginx 0.6.36 F5 Nginx 0.6.37 F5 Nginx 0.6.38 F5 Nginx 0.6.39 F5 Nginx 0.7.0 F5 Nginx 0.7.1 F5 Nginx 0.7.2 F5 Nginx 0.7.3 F5 Nginx 0.7.4 F5 Nginx 0.7.5 F5 Nginx 0.7.6 F5 Nginx 0.7.7 F5 Nginx 0.7.8 F5 Nginx 0.7.9 F5 Nginx 0.7.10 F5 Nginx 0.7.11 F5 Nginx 0.7.12 F5 Nginx 0.7.13 F5 Nginx 0.7.14 F5 Nginx 0.7.15 F5 Nginx 0.7.16 F5 Nginx 0.7.17 F5 Nginx 0.7.18 F5 Nginx 0.7.19 F5 Nginx 0.7.20 F5 Nginx 0.7.21 F5 Nginx 0.7.22 F5 Nginx 0.7.23 F5 Nginx 0.7.24 F5 Nginx 0.7.25 F5 Nginx 0.7.26 F5 Nginx 0.7.27 F5 Nginx 0.7.28 F5 Nginx 0.7.29 F5 Nginx 0.7.30 F5 Nginx 0.7.31 F5 Nginx 0.7.32 F5 Nginx 0.7.33 F5 Nginx 0.7.34 F5 Nginx 0.7.35 F5 Nginx 0.7.36 F5 Nginx 0.7.37 F5 Nginx 0.7.38 F5 Nginx 0.7.39 F5 Nginx 0.7.40 F5 Nginx 0.7.41 F5 Nginx 0.7.42 F5 Nginx 0.7.43 F5 Nginx 0.7.44 F5 Nginx 0.7.45 F5 Nginx 0.7.46 F5 Nginx 0.7.47 F5 Nginx 0.7.48 F5 Nginx 0.7.49 F5 Nginx 0.7.50 F5 Nginx 0.7.51 F5 Nginx 0.7.52 F5 Nginx 0.7.53 F5 Nginx 0.7.54 F5 Nginx 0.7.55 F5 Nginx 0.7.56 F5 Nginx 0.7.57 F5 Nginx 0.7.58 F5 Nginx 0.7.59 F5 Nginx 0.7.60 F5 Nginx 0.7.61 F5 Nginx 0.7.62 F5 Nginx 0.7.63 F5 Nginx 0.7.64 F5 Nginx 0.7.65 F5 Nginx 0.7.66 F5 Nginx 0.7.67 F5 Nginx 0.7.68 F5 Nginx 0.7.69 F5 Nginx 0.8.0 F5 Nginx 0.8.1 F5 Nginx 0.8.2 F5 Nginx 0.8.3 F5 Nginx 0.8.4 F5 Nginx 0.8.5 F5 Nginx 0.8.6 F5 Nginx 0.8.7 F5 Nginx 0.8.8 F5 Nginx 0.8.9 F5 Nginx 0.8.10 F5 Nginx 0.8.11 F5 Nginx 0.8.12 F5 Nginx 0.8.13 F5 Nginx 0.8.14 F5 Nginx 0.8.15 F5 Nginx 0.8.16 F5 Nginx 0.8.17 F5 Nginx 0.8.18 F5 Nginx 0.8.19 F5 Nginx 0.8.20 F5 Nginx 0.8.21 F5 Nginx 0.8.22 F5 Nginx 0.8.23 F5 Nginx 0.8.24 F5 Nginx 0.8.25 F5 Nginx 0.8.26 F5 Nginx 0.8.27 F5 Nginx 0.8.28 F5 Nginx 0.8.29 F5 Nginx 0.8.30 F5 Nginx 0.8.31 F5 Nginx 0.8.32 F5 Nginx 0.8.33 F5 Nginx 0.8.34 F5 Nginx 0.8.35 F5 Nginx 0.8.36 F5 Nginx 0.8.37 F5 Nginx 0.8.38 F5 Nginx 0.8.39 F5 Nginx 0.8.40 F5 Nginx 0.8.41 F5 Nginx 0.8.42 F5 Nginx 0.8.43 F5 Nginx 0.8.44 F5 Nginx 0.8.45 F5 Nginx 0.8.46 F5 Nginx 0.8.47 F5 Nginx 0.8.48 F5 Nginx 0.8.49 F5 Nginx 0.8.50 F5 Nginx 0.8.51 F5 Nginx 0.8.52 F5 Nginx 0.8.53 F5 Nginx 0.8.54 F5 Nginx 0.8.55 F5 Nginx 0.9.0 F5 Nginx 0.9.1 F5 Nginx 0.9.2 F5 Nginx 0.9.3 F5 Nginx 0.9.4 F5 Nginx 0.9.5 F5 Nginx 0.9.6 F5 Nginx 0.9.7 F5 Nginx 1.0.0 F5 Nginx 1.0.1 F5 Nginx 1.0.2 F5 Nginx 1.0.3 F5 Nginx 1.0.4 F5 Nginx 1.0.5 F5 Nginx 1.0.6 F5 Nginx 1.0.7 F5 Nginx 1.0.8 F5 Nginx 1.0.9 F5 Nginx 1.0.10 F5 Nginx 1.0.11 F5 Nginx 1.0.12 F5 Nginx 1.0.13 F5 Nginx 1.0.14 F5 Nginx 1.0.15 F5 Nginx 1.1.0 F5 Nginx 1.1.1 F5 Nginx 1.1.2 F5 Nginx 1.1.3 F5 Nginx 1.1.4 F5 Nginx 1.1.5 F5 Nginx 1.1.6 F5 Nginx 1.1.7 F5 Nginx 1.1.8 F5 Nginx 1.1.9 F5 Nginx 1.1.10 F5 Nginx 1.1.11 F5 Nginx 1.1.12 F5 Nginx 1.1.13 F5 Nginx 1.1.14 F5 Nginx 1.1.15 F5 Nginx 1.1.16 F5 Nginx 1.1.17 F5 Nginx 1.1.18 F5 Nginx 1.1.19 F5 Nginx 1.2.0 F5 Nginx 1.2.1 F5 Nginx 1.2.2 F5 Nginx 1.2.3 F5 Nginx 1.2.4 F5 Nginx 1.2.5 F5 Nginx 1.2.6 F5 Nginx 1.2.7 F5 Nginx 1.2.8 F5 Nginx 1.2.9 F5 Nginx 1.3.0 F5 Nginx 1.3.1 F5 Nginx 1.3.2 F5 Nginx 1.3.3 F5 Nginx 1.3.4 F5 Nginx 1.3.5 F5 Nginx 1.3.6 F5 Nginx 1.3.7 F5 Nginx 1.3.8 F5 Nginx 1.3.9 F5 Nginx 1.3.10 F5 Nginx 1.3.11 F5 Nginx 1.3.12 F5 Nginx 1.3.13 F5 Nginx 1.3.14 F5 Nginx 1.3.15 F5 Nginx 1.3.16 F5 Nginx 1.4.0 F5 Nginx 1.4.1 F5 Nginx 1.4.2 F5 Nginx 1.4.3 F5 Nginx 1.4.4 F5 Nginx 1.4.5 F5 Nginx 1.4.6 F5 Nginx 1.4.7 F5 Nginx 1.5.0 F5 Nginx 1.5.1 F5 Nginx 1.5.2 F5 Nginx 1.5.3 F5 Nginx 1.5.4 F5 Nginx 1.5.5 F5 Nginx 1.5.6 F5 Nginx 1.5.7 F5 Nginx 1.5.8 F5 Nginx 1.5.9 F5 Nginx 1.5.10 F5 Nginx 1.5.11 F5 Nginx 1.5.12 F5 Nginx 1.5.13 F5 Nginx 1.6.0 F5 Nginx 1.6.1 F5 Nginx 1.6.2 F5 Nginx 1.6.3 F5 Nginx 1.7.0 F5 Nginx 1.7.4 F5 Nginx 1.7.5 F5 Nginx 1.7.6 F5 Nginx 1.7.7 F5 Nginx 1.7.8 F5 Nginx 1.7.9 F5 Nginx 1.7.10 F5 Nginx 1.7.11 F5 Nginx 1.7.12 F5 Nginx 1.8.0 F5 Nginx 1.8.1 F5 Nginx 1.9.0 F5 Nginx 1.9.1 F5 Nginx 1.9.2 F5 Nginx 1.9.3 F5 Nginx 1.9.4 F5 Nginx 1.9.5 F5 Nginx 1.9.6 F5 Nginx 1.9.7 F5 Nginx 1.9.8 F5 Nginx 1.9.9 F5 Nginx 1.9.10 F5 Nginx 1.9.11 F5 Nginx 1.9.12 F5 Nginx 1.9.13 F5 Nginx 1.9.14 F5 Nginx 1.9.15 F5 Nginx 1.10.0 F5 Nginx 1.10.1 F5 Nginx 1.10.2 F5 Nginx 1.10.3 F5 Nginx 1.11.0 F5 Nginx 1.11.1 F5 Nginx 1.11.2 F5 Nginx 1.11.3 F5 Nginx 1.11.4 F5 Nginx 1.11.5 F5 Nginx 1.11.6 F5 Nginx 1.11.7 F5 Nginx 1.11.8 F5 Nginx 1.11.9 F5 Nginx 1.11.10 F5 Nginx 1.11.11 F5 Nginx 1.11.12 F5 Nginx 1.11.13 F5 Nginx 1.12.0 F5 Nginx 1.12.1 F5 Nginx 1.12.2 F5 Nginx 1.13.0 F5 Nginx 1.13.1 F5 Nginx 1.13.2 F5 Nginx 1.13.3 F5 Nginx 1.13.4 F5 Nginx 1.13.5 F5 Nginx 1.13.6 F5 Nginx 1.13.7 F5 Nginx 1.13.8 F5 Nginx 1.13.9 F5 Nginx 1.13.10 F5 Nginx 1.13.11 F5 Nginx 1.13.12 F5 Nginx 1.14.0 F5 Nginx 1.14.1 F5 Nginx 1.14.2 F5 Nginx 1.15.0 F5 Nginx 1.15.1 F5 Nginx 1.15.2 F5 Nginx 1.15.3 F5 Nginx 1.15.4 F5 Nginx 1.15.5 F5 Nginx 1.15.6 F5 Nginx 1.15.7 F5 Nginx 1.15.8 F5 Nginx 1.15.9 F5 Nginx 1.15.10 F5 Nginx 1.15.11 F5 Nginx 1.15.12 F5 Nginx 1.16.0 F5 Nginx 1.16.1 F5 Nginx 1.17.0 F5 Nginx 1.17.1 F5 Nginx 1.17.2 F5 Nginx 1.17.3 F5 Nginx 1.17.4 F5 Nginx 1.17.5 F5 Nginx 1.17.6	520
Application	Apple Apple Xcode - Apple Xcode 1.5.0 Apple Xcode 2.0.0 Apple Xcode 2.1.0 Apple Xcode 2.2.0 Apple Xcode 2.3.0 Apple Xcode 2.4.0 Apple Xcode 2.4.1 Apple Xcode 3.1 Apple Xcode 3.1.1 Apple Xcode 3.1.2 Apple Xcode 3.1.3 Apple Xcode 3.1.4 Apple Xcode 3.2.1 Apple Xcode 3.2.2 Apple Xcode 3.2.3 Apple Xcode 3.2.4 Apple Xcode 3.2.5 Apple Xcode 4.0 Apple Xcode 4.0.1 Apple Xcode 4.0.2 Apple Xcode 4.1 Apple Xcode 4.1.1 Apple Xcode 4.2 Apple Xcode 4.2.1 Apple Xcode 4.3 Apple Xcode 4.3.1 Apple Xcode 4.3.2 Apple Xcode 4.3.3 Apple Xcode 4.4 Apple Xcode 4.4.1 Apple Xcode 4.5 Apple Xcode 4.5.1 Apple Xcode 4.5.2 Apple Xcode 4.6 Apple Xcode 4.6.1 Apple Xcode 4.6.2 Apple Xcode 4.6.3 Apple Xcode 5.0 Apple Xcode 5.0.1 Apple Xcode 5.0.2 Apple Xcode 5.1 Apple Xcode 5.1.1 Apple Xcode 6.0 Apple Xcode 6.0.1 Apple Xcode 6.1 Apple Xcode 6.1.1 Apple Xcode 6.2 Apple Xcode 6.3 Apple Xcode 6.3.1 Apple Xcode 6.3.2 Apple Xcode 6.4 Apple Xcode 7.0 Apple Xcode 7.0.1 Apple Xcode 7.1 Apple Xcode 7.1.1 Apple Xcode 7.2 Apple Xcode 7.2.1 Apple Xcode 7.3 Apple Xcode 7.3.1 Apple Xcode 8.0 Apple Xcode 8.1 Apple Xcode 8.2 Apple Xcode 8.2.1 Apple Xcode 8.3 Apple Xcode 8.3.1 Apple Xcode 8.3.2 Apple Xcode 8.3.3 Apple Xcode 9.0 Apple Xcode 9.0.1 Apple Xcode 9.1 Apple Xcode 9.2 Apple Xcode 9.3 Apple Xcode 9.3.1 Apple Xcode 9.4 Apple Xcode 9.4.1 Apple Xcode 10 Apple Xcode 11.0 Apple Xcode 11.2 Apple Xcode 11.3 Apple Xcode 12.0 Apple Xcode 12.4 Apple Xcode 12.5 Apple Xcode 12.5.1	85
Application	Netapp Netapp Cloud Backup -	1
OS	Canonical Canonical Ubuntu Linux 14.04	1
OS	Opensuse Opensuse Leap 15.1	1

Common Weakness Enumeration (CWE)

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

Common Attack Pattern Enumeration and Classification (CAPEC)

HTTP Request Splitting
HTTP Request Splitting (also known as HTTP Request Smuggling) is an attack pattern where an attacker attempts to insert additional HTTP requests in the body of the original (enveloping) HTTP request in such a way that the browser interprets it as one request but the web server interprets it as two. There are several ways to perform HTTP request splitting attacks. One way is to include double Content-Length headers in the request to exploit the fact that the devices parsing the request may each use a different header. Another way is to submit an HTTP request with a "Transfer Encoding: chunked" in the request header set with setRequestHeader to allow a payload in the HTTP Request that can be considered as another HTTP Request by a subsequent parsing entity. A third way is to use the "Double CR in an HTTP header" technique. There are also a few less general techniques targeting specific parsing vulnerabilities in certain web servers.
HTTP Request Smuggling
HTTP Request Smuggling results from the discrepancies in parsing HTTP requests between HTTP entities such as web caching proxies or application firewalls. Entities such as web servers, web caching proxies, application firewalls or simple proxies often parse HTTP requests in slightly different ways. Under specific situations where there are two or more such entities in the path of the HTTP request, a specially crafted request is seen by two attacked entities as two different sets of requests. This allows certain requests to be smuggled through to a second entity without the first one realizing it.

Nessus

NASL family	FreeBSD Local Security Checks
NASL id	FREEBSD_PKG_C1202DE84B2911EA96734C72B94353B5.NASL
description	NGINX Team reports : NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.
last seen	2020-06-01
modified	2020-06-02
plugin id	133589
published	2020-02-10
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/133589
title	FreeBSD : NGINX -- HTTP request smuggling (c1202de8-4b29-11ea-9673-4c72b94353b5)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from the FreeBSD VuXML database : # # Copyright 2003-2020 Jacques Vidrine and contributors # # Redistribution and use in source (VuXML) and 'compiled' forms (SGML, # HTML, PDF, PostScript, RTF and so forth) with or without modification, # are permitted provided that the following conditions are met: # 1. Redistributions of source code (VuXML) must retain the above # copyright notice, this list of conditions and the following # disclaimer as the first lines of this file unmodified. # 2. Redistributions in compiled form (transformed to other DTDs, # published online in any format, converted to PDF, PostScript, # RTF and other formats) must reproduce the above copyright # notice, this list of conditions and the following disclaimer # in the documentation and/or other materials provided with the # distribution. # # THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS "AS IS" # AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, # THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR # PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS # BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT # OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR # BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, # WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION, # EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. # include("compat.inc"); if (description) { script_id(133589); script_version("1.2"); script_cvs_date("Date: 2020/02/12"); script_cve_id("CVE-2019-20372"); script_name(english:"FreeBSD : NGINX -- HTTP request smuggling (c1202de8-4b29-11ea-9673-4c72b94353b5)"); script_summary(english:"Checks for updated packages in pkg_info output"); script_set_attribute( attribute:"synopsis", value: "The remote FreeBSD host is missing one or more security-related updates." ); script_set_attribute( attribute:"description", value: "NGINX Team reports : NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer." ); # https://vuxml.freebsd.org/freebsd/c1202de8-4b29-11ea-9673-4c72b94353b5.html script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?74b52861" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:nginx"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:freebsd:freebsd:nginx-devel"); script_set_attribute(attribute:"cpe", value:"cpe:/o:freebsd:freebsd"); script_set_attribute(attribute:"vuln_publication_date", value:"2019/12/10"); script_set_attribute(attribute:"patch_publication_date", value:"2020/02/09"); script_set_attribute(attribute:"plugin_publication_date", value:"2020/02/10"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"FreeBSD Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/FreeBSD/release", "Host/FreeBSD/pkg_info"); exit(0); } include("audit.inc"); include("freebsd_package.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/FreeBSD/release")) audit(AUDIT_OS_NOT, "FreeBSD"); if (!get_kb_item("Host/FreeBSD/pkg_info")) audit(AUDIT_PACKAGE_LIST_MISSING); flag = 0; if (pkg_test(save_report:TRUE, pkg:"nginx<1.16.1_11,2")) flag++; if (pkg_test(save_report:TRUE, pkg:"nginx-devel<1.17.7")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get()); else security_warning(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");

NASL family	PhotonOS Local Security Checks
NASL id	PHOTONOS_PHSA-2020-3_0-0057_NGINX.NASL
description	An update of the nginx package has been released.
last seen	2020-03-17
modified	2020-02-20
plugin id	133808
published	2020-02-20
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/133808
title	Photon OS 3.0: Nginx PHSA-2020-3.0-0057
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from VMware Security Advisory PHSA-2020-3.0-0057. The text # itself is copyright (C) VMware, Inc. include('compat.inc'); if (description) { script_id(133808); script_version("1.2"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/02/24"); script_cve_id("CVE-2019-20372"); script_name(english:"Photon OS 3.0: Nginx PHSA-2020-3.0-0057"); script_set_attribute(attribute:"synopsis", value: "The remote PhotonOS host is missing multiple security updates."); script_set_attribute(attribute:"description", value: "An update of the nginx package has been released."); script_set_attribute(attribute:"see_also", value:"https://github.com/vmware/photon/wiki/Security-Updates-3.0-57.md"); script_set_attribute(attribute:"solution", value: "Update the affected Linux packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-20372"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"vuln_publication_date", value:"2020/01/09"); script_set_attribute(attribute:"patch_publication_date", value:"2020/02/14"); script_set_attribute(attribute:"plugin_publication_date", value:"2020/02/20"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:vmware:photonos:nginx"); script_set_attribute(attribute:"cpe", value:"cpe:/o:vmware:photonos:3.0"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"PhotonOS Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/PhotonOS/release", "Host/PhotonOS/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/PhotonOS/release"); if (isnull(release) \|\| release !~ "^VMware Photon") audit(AUDIT_OS_NOT, "PhotonOS"); if (release !~ "^VMware Photon (?:Linux\|OS) 3\.0(\D\|$)") audit(AUDIT_OS_NOT, "PhotonOS 3.0"); if (!get_kb_item("Host/PhotonOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "PhotonOS", cpu); flag = 0; if (rpm_check(release:"PhotonOS-3.0", cpu:"x86_64", reference:"nginx-1.16.1-2.ph3")) flag++; if (rpm_check(release:"PhotonOS-3.0", cpu:"x86_64", reference:"nginx-debuginfo-1.16.1-2.ph3")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : rpm_report_get() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "nginx"); }

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2020-1167.NASL
description	According to the version of the nginx packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.(CVE-2019-20372) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-05-03
modified	2020-02-25
plugin id	134001
published	2020-02-25
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/134001
title	EulerOS 2.0 SP8 : nginx (EulerOS-SA-2020-1167)
code	# # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(134001); script_version("1.4"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/01"); script_cve_id( "CVE-2019-20372" ); script_name(english:"EulerOS 2.0 SP8 : nginx (EulerOS-SA-2020-1167)"); script_summary(english:"Checks the rpm output for the updated package."); script_set_attribute(attribute:"synopsis", value: "The remote EulerOS host is missing a security update."); script_set_attribute(attribute:"description", value: "According to the version of the nginx packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.(CVE-2019-20372) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues."); # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2020-1167 script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e620b0f9"); script_set_attribute(attribute:"solution", value: "Update the affected nginx package."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"patch_publication_date", value:"2020/02/25"); script_set_attribute(attribute:"plugin_publication_date", value:"2020/02/25"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:nginx"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:nginx-all-modules"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:nginx-filesystem"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:nginx-mod-http-image-filter"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:nginx-mod-http-perl"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:nginx-mod-http-xslt-filter"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:nginx-mod-mail"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:nginx-mod-stream"); script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Huawei Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp"); script_exclude_keys("Host/EulerOS/uvp_version"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/EulerOS/release"); if (isnull(release) \|\| release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS"); if (release !~ "^EulerOS release 2\.0(\D\|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0"); sp = get_kb_item("Host/EulerOS/sp"); if (isnull(sp) \|\| sp !~ "^(8)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP8"); uvp = get_kb_item("Host/EulerOS/uvp_version"); if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP8", "EulerOS UVP " + uvp); if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu); if ("aarch64" >!< cpu) audit(AUDIT_ARCH_NOT, "aarch64", cpu); flag = 0; pkgs = ["nginx-1.12.1-14.h2.eulerosv2r8", "nginx-all-modules-1.12.1-14.h2.eulerosv2r8", "nginx-filesystem-1.12.1-14.h2.eulerosv2r8", "nginx-mod-http-image-filter-1.12.1-14.h2.eulerosv2r8", "nginx-mod-http-perl-1.12.1-14.h2.eulerosv2r8", "nginx-mod-http-xslt-filter-1.12.1-14.h2.eulerosv2r8", "nginx-mod-mail-1.12.1-14.h2.eulerosv2r8", "nginx-mod-stream-1.12.1-14.h2.eulerosv2r8"]; foreach (pkg in pkgs) if (rpm_check(release:"EulerOS-2.0", sp:"8", reference:pkg)) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : rpm_report_get() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "nginx"); }

NASL family	PhotonOS Local Security Checks
NASL id	PHOTONOS_PHSA-2020-2_0-0207_NGINX.NASL
description	An update of the nginx package has been released.
last seen	2020-03-17
modified	2020-02-13
plugin id	133689
published	2020-02-13
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/133689
title	Photon OS 2.0: Nginx PHSA-2020-2.0-0207
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from VMware Security Advisory PHSA-2020-2.0-0207. The text # itself is copyright (C) VMware, Inc. include('compat.inc'); if (description) { script_id(133689); script_version("1.2"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/02/13"); script_cve_id("CVE-2019-20372"); script_name(english:"Photon OS 2.0: Nginx PHSA-2020-2.0-0207"); script_set_attribute(attribute:"synopsis", value: "The remote PhotonOS host is missing multiple security updates."); script_set_attribute(attribute:"description", value: "An update of the nginx package has been released."); script_set_attribute(attribute:"see_also", value:"https://github.com/vmware/photon/wiki/Security-Updates-2-207.md"); script_set_attribute(attribute:"solution", value: "Update the affected Linux packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-20372"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"vuln_publication_date", value:"2020/01/09"); script_set_attribute(attribute:"patch_publication_date", value:"2020/02/13"); script_set_attribute(attribute:"plugin_publication_date", value:"2020/02/13"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:vmware:photonos:nginx"); script_set_attribute(attribute:"cpe", value:"cpe:/o:vmware:photonos:2.0"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"PhotonOS Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/PhotonOS/release", "Host/PhotonOS/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/PhotonOS/release"); if (isnull(release) \|\| release !~ "^VMware Photon") audit(AUDIT_OS_NOT, "PhotonOS"); if (release !~ "^VMware Photon (?:Linux\|OS) 2\.0(\D\|$)") audit(AUDIT_OS_NOT, "PhotonOS 2.0"); if (!get_kb_item("Host/PhotonOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "PhotonOS", cpu); flag = 0; if (rpm_check(release:"PhotonOS-2.0", cpu:"x86_64", reference:"nginx-1.16.1-2.ph2")) flag++; if (rpm_check(release:"PhotonOS-2.0", cpu:"x86_64", reference:"nginx-debuginfo-1.16.1-2.ph2")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : rpm_report_get() ); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "nginx"); }

NASL family	Ubuntu Local Security Checks
NASL id	UBUNTU_USN-4235-1.NASL
description	Bert JW Regeer and Francisco Oca Gonzalez discovered that nginx incorrectly handled certain error_page configurations. A remote attacker could possibly use this issue to perform HTTP request smuggling attacks and access resources contrary to expectations. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	132929
published	2020-01-15
reporter	Ubuntu Security Notice (C) 2020 Canonical, Inc. / NASL script (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/132929
title	Ubuntu 16.04 LTS / 18.04 LTS / 19.04 / 19.10 : nginx vulnerability (USN-4235-1)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Ubuntu Security Notice USN-4235-1. The text # itself is copyright (C) Canonical, Inc. See # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered # trademark of Canonical, Inc. # include("compat.inc"); if (description) { script_id(132929); script_version("1.3"); script_cvs_date("Date: 2020/01/17"); script_cve_id("CVE-2019-20372"); script_xref(name:"USN", value:"4235-1"); script_name(english:"Ubuntu 16.04 LTS / 18.04 LTS / 19.04 / 19.10 : nginx vulnerability (USN-4235-1)"); script_summary(english:"Checks dpkg output for updated packages."); script_set_attribute( attribute:"synopsis", value: "The remote Ubuntu host is missing one or more security-related patches." ); script_set_attribute( attribute:"description", value: "Bert JW Regeer and Francisco Oca Gonzalez discovered that nginx incorrectly handled certain error_page configurations. A remote attacker could possibly use this issue to perform HTTP request smuggling attacks and access resources contrary to expectations. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://usn.ubuntu.com/4235-1/" ); script_set_attribute(attribute:"solution", value:"Update the affected packages."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-20372"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:nginx-common"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:nginx-core"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:nginx-extras"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:nginx-full"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:nginx-light"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:16.04"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:18.04:-:lts"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:19.04"); script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:19.10"); script_set_attribute(attribute:"vuln_publication_date", value:"2020/01/09"); script_set_attribute(attribute:"patch_publication_date", value:"2020/01/13"); script_set_attribute(attribute:"plugin_publication_date", value:"2020/01/15"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"Ubuntu Security Notice (C) 2020 Canonical, Inc. / NASL script (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"Ubuntu Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l"); exit(0); } include("audit.inc"); include("ubuntu.inc"); include("misc_func.inc"); if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/Ubuntu/release"); if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu"); release = chomp(release); if (! preg(pattern:"^(16\.04\|18\.04\|19\.04\|19\.10)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 16.04 / 18.04 / 19.04 / 19.10", "Ubuntu " + release); if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu); flag = 0; if (ubuntu_check(osver:"16.04", pkgname:"nginx-common", pkgver:"1.10.3-0ubuntu0.16.04.5")) flag++; if (ubuntu_check(osver:"16.04", pkgname:"nginx-core", pkgver:"1.10.3-0ubuntu0.16.04.5")) flag++; if (ubuntu_check(osver:"16.04", pkgname:"nginx-extras", pkgver:"1.10.3-0ubuntu0.16.04.5")) flag++; if (ubuntu_check(osver:"16.04", pkgname:"nginx-full", pkgver:"1.10.3-0ubuntu0.16.04.5")) flag++; if (ubuntu_check(osver:"16.04", pkgname:"nginx-light", pkgver:"1.10.3-0ubuntu0.16.04.5")) flag++; if (ubuntu_check(osver:"18.04", pkgname:"nginx-common", pkgver:"1.14.0-0ubuntu1.7")) flag++; if (ubuntu_check(osver:"18.04", pkgname:"nginx-core", pkgver:"1.14.0-0ubuntu1.7")) flag++; if (ubuntu_check(osver:"18.04", pkgname:"nginx-extras", pkgver:"1.14.0-0ubuntu1.7")) flag++; if (ubuntu_check(osver:"18.04", pkgname:"nginx-full", pkgver:"1.14.0-0ubuntu1.7")) flag++; if (ubuntu_check(osver:"18.04", pkgname:"nginx-light", pkgver:"1.14.0-0ubuntu1.7")) flag++; if (ubuntu_check(osver:"19.04", pkgname:"nginx-common", pkgver:"1.15.9-0ubuntu1.2")) flag++; if (ubuntu_check(osver:"19.04", pkgname:"nginx-core", pkgver:"1.15.9-0ubuntu1.2")) flag++; if (ubuntu_check(osver:"19.04", pkgname:"nginx-extras", pkgver:"1.15.9-0ubuntu1.2")) flag++; if (ubuntu_check(osver:"19.04", pkgname:"nginx-full", pkgver:"1.15.9-0ubuntu1.2")) flag++; if (ubuntu_check(osver:"19.04", pkgname:"nginx-light", pkgver:"1.15.9-0ubuntu1.2")) flag++; if (ubuntu_check(osver:"19.10", pkgname:"nginx-common", pkgver:"1.16.1-0ubuntu2.1")) flag++; if (ubuntu_check(osver:"19.10", pkgname:"nginx-core", pkgver:"1.16.1-0ubuntu2.1")) flag++; if (ubuntu_check(osver:"19.10", pkgname:"nginx-extras", pkgver:"1.16.1-0ubuntu2.1")) flag++; if (ubuntu_check(osver:"19.10", pkgname:"nginx-full", pkgver:"1.16.1-0ubuntu2.1")) flag++; if (ubuntu_check(osver:"19.10", pkgname:"nginx-light", pkgver:"1.16.1-0ubuntu2.1")) flag++; if (flag) { security_report_v4( port : 0, severity : SECURITY_WARNING, extra : ubuntu_report_get() ); exit(0); } else { tested = ubuntu_pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "nginx-common / nginx-core / nginx-extras / nginx-full / nginx-light"); }

NASL family	Web Servers
NASL id	NGINX_1_17_7.NASL
description	According to its Server response header, the installed version of nginx is prior to 1.17.7. It is, therefore, affected by an information disclosure vulnerability.
last seen	2020-05-09
modified	2020-03-05
plugin id	134220
published	2020-03-05
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/134220
title	nginx < 1.17.7 Information Disclosure
code	# # (C) Tenable Network Security, Inc. # include('compat.inc'); if (description) { script_id(134220); script_version("1.4"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/08"); script_cve_id("CVE-2019-20372"); script_xref(name:"IAVB", value:"2020-B-0013"); script_name(english:"nginx < 1.17.7 Information Disclosure"); script_set_attribute(attribute:"synopsis", value: "The remote web server is affected by an information disclosure vulnerability."); script_set_attribute(attribute:"description", value: "According to its Server response header, the installed version of nginx is prior to 1.17.7. It is, therefore, affected by an information disclosure vulnerability."); # https://nginx.org/en/CHANGES script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?fd026623"); script_set_attribute(attribute:"solution", value: "Upgrade to nginx version 1.17.7 or later."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-20372"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"vuln_publication_date", value:"2019/12/24"); script_set_attribute(attribute:"patch_publication_date", value:"2019/12/24"); script_set_attribute(attribute:"plugin_publication_date", value:"2020/03/05"); script_set_attribute(attribute:"plugin_type", value:"combined"); script_set_attribute(attribute:"cpe", value:"cpe:/a:igor_sysoev:nginx"); script_set_attribute(attribute:"stig_severity", value:"I"); script_set_attribute(attribute:"agent", value:"unix"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Web Servers"); script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("nginx_detect.nasl", "nginx_nix_installed.nbin"); script_require_keys("installed_sw/nginx"); exit(0); } include('http.inc'); include('vcf.inc'); appname = 'nginx'; get_install_count(app_name:appname, exit_if_zero:TRUE); app_info = vcf::combined_get_app_info(app:appname); vcf::check_granularity(app_info:app_info, sig_segments:3); # If the detection is only remote, Detection Method won't be set, and we should require paranoia if (empty_or_null(app_info['Detection Method']) && report_paranoia < 2) audit(AUDIT_PARANOID); constraints = [ {'fixed_version' : '1.17.7'} ]; vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2020-1171-1.NASL
description	This update for nginx fixes the following issues : nginx was updated to 1.16.1 (jsc#ECO-1401) Added TLS 1.3 support (jsc#SLE-9295, bsc#1150711) Replaced obsolete GeoIP module with MaxMinDB-based GeoIP2 (jsc#SLE-11184, bsc#1156202) Started nginx after network is online (bsc#1155690) CVE-2019-20372: Fixed an HTTP request smuggling with certain error_page configurations which could have allowed unauthorized web page reads (bsc#1160682). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-05-12
modified	2020-05-07
plugin id	136397
published	2020-05-07
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/136397
title	SUSE SLES15 Security Update : nginx (SUSE-SU-2020:1171-1)
code	# # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from SUSE update advisory SUSE-SU-2020:1171-1. # The text itself is copyright (C) SUSE. # include("compat.inc"); if (description) { script_id(136397); script_version("1.2"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/11"); script_cve_id("CVE-2019-20372"); script_name(english:"SUSE SLES15 Security Update : nginx (SUSE-SU-2020:1171-1)"); script_summary(english:"Checks rpm output for the updated packages."); script_set_attribute( attribute:"synopsis", value:"The remote SUSE host is missing one or more security updates." ); script_set_attribute( attribute:"description", value: "This update for nginx fixes the following issues : nginx was updated to 1.16.1 (jsc#ECO-1401) Added TLS 1.3 support (jsc#SLE-9295, bsc#1150711) Replaced obsolete GeoIP module with MaxMinDB-based GeoIP2 (jsc#SLE-11184, bsc#1156202) Started nginx after network is online (bsc#1155690) CVE-2019-20372: Fixed an HTTP request smuggling with certain error_page configurations which could have allowed unauthorized web page reads (bsc#1160682). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues." ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1150711" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1155690" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1156202" ); script_set_attribute( attribute:"see_also", value:"https://bugzilla.suse.com/show_bug.cgi?id=1160682" ); script_set_attribute( attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2019-20372/" ); # https://www.suse.com/support/update/announcement/2020/suse-su-20201171-1/ script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?472b4944" ); script_set_attribute( attribute:"solution", value: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or 'zypper patch'. Alternatively you can run the command listed for your product : SUSE Linux Enterprise Server for SAP 15 : zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-2020-1171=1 SUSE Linux Enterprise Server 15-LTSS : zypper in -t patch SUSE-SLE-Product-SLES-15-2020-1171=1 SUSE Linux Enterprise High Performance Computing 15-LTSS : zypper in -t patch SUSE-SLE-Product-HPC-15-2020-1171=1 SUSE Linux Enterprise High Performance Computing 15-ESPOS : zypper in -t patch SUSE-SLE-Product-HPC-15-2020-1171=1" ); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:nginx"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:nginx-debuginfo"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:nginx-debugsource"); script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:15"); script_set_attribute(attribute:"vuln_publication_date", value:"2020/01/09"); script_set_attribute(attribute:"patch_publication_date", value:"2020/05/04"); script_set_attribute(attribute:"plugin_publication_date", value:"2020/05/07"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); release = get_kb_item("Host/SuSE/release"); if (isnull(release) \|\| release !~ "^(SLED\|SLES)") audit(AUDIT_OS_NOT, "SUSE"); os_ver = pregmatch(pattern: "^(SLE(S\|D)\d+)", string:release); if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE"); os_ver = os_ver[1]; if (! preg(pattern:"^(SLES15)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLES15", "SUSE " + os_ver); if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu); if (cpu >!< "s390x") audit(AUDIT_ARCH_NOT, "s390x", cpu); sp = get_kb_item("Host/SuSE/patchlevel"); if (isnull(sp)) sp = "0"; if (os_ver == "SLES15" && (! preg(pattern:"^(0)$", string:sp))) audit(AUDIT_OS_NOT, "SLES15 SP0", os_ver + " SP" + sp); flag = 0; if (rpm_check(release:"SLES15", sp:"0", cpu:"s390x", reference:"nginx-1.16.1-3.12.7")) flag++; if (rpm_check(release:"SLES15", sp:"0", cpu:"s390x", reference:"nginx-debuginfo-1.16.1-3.12.7")) flag++; if (rpm_check(release:"SLES15", sp:"0", cpu:"s390x", reference:"nginx-debugsource-1.16.1-3.12.7")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else { tested = pkg_tests_get(); if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested); else audit(AUDIT_PACKAGE_NOT_INSTALLED, "nginx"); }

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2020-1119.NASL
description	According to the version of the nginx packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.(CVE-2019-20372) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-05-06
modified	2020-02-24
plugin id	133920
published	2020-02-24
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/133920
title	EulerOS 2.0 SP5 : nginx (EulerOS-SA-2020-1119)

NASL family	Huawei Local Security Checks
NASL id	EULEROS_SA-2020-1413.NASL
description	According to the version of the nginx package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.(CVE-2019-20372) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-05-06
modified	2020-04-15
plugin id	135542
published	2020-04-15
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/135542
title	EulerOS 2.0 SP3 : nginx (EulerOS-SA-2020-1413)

NASL family	SuSE Local Security Checks
NASL id	OPENSUSE-2020-204.NASL
description	This update for nginx fixes the following issues : - CVE-2019-20372: Fixed an HTTP request smuggling with certain error_page configurations which could have allowed unauthorized web page reads (bsc#1160682). This update was imported from the SUSE:SLE-15-SP1:Update update project.
last seen	2020-06-01
modified	2020-06-02
plugin id	133644
published	2020-02-12
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/133644
title	openSUSE Security Update : nginx (openSUSE-2020-204)

NASL family	PhotonOS Local Security Checks
NASL id	PHOTONOS_PHSA-2020-1_0-0276_NGINX.NASL
description	An update of the nginx package has been released.
last seen	2020-03-17
modified	2020-02-13
plugin id	133684
published	2020-02-13
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/133684
title	Photon OS 1.0: Nginx PHSA-2020-1.0-0276

NASL family	SuSE Local Security Checks
NASL id	SUSE_SU-2020-0348-1.NASL
description	This update for nginx fixes the following issues : CVE-2019-20372: Fixed an HTTP request smuggling with certain error_page configurations which could have allowed unauthorized web page reads (bsc#1160682). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
last seen	2020-06-01
modified	2020-06-02
plugin id	133543
published	2020-02-07
reporter	This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
source	https://www.tenable.com/plugins/nessus/133543
title	SUSE SLES15 Security Update : nginx (SUSE-SU-2020:0348-1)

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

Nessus

References