From 8e1f0fa6bfac0e96fedc666fe9066f92c85afb27 Mon Sep 17 00:00:00 2001 From: Meenali Gupta Date: Thu, 21 Dec 2023 03:45:50 +0000 Subject: nginx: fix CVE-2023-44487 The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. Signed-off-by: Meenali Gupta Signed-off-by: Armin Kuster --- meta-webserver/recipes-httpd/nginx/nginx.inc | 1 + 1 file changed, 1 insertion(+) (limited to 'meta-webserver/recipes-httpd/nginx/nginx.inc') diff --git a/meta-webserver/recipes-httpd/nginx/nginx.inc b/meta-webserver/recipes-httpd/nginx/nginx.inc index 8078b7621a..72a7bb0c1c 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx.inc +++ b/meta-webserver/recipes-httpd/nginx/nginx.inc @@ -23,6 +23,7 @@ SRC_URI = " \ file://nginx.service \ file://nginx-fix-pidfile.patch \ file://0001-configure-libxslt-conf.patch \ + file://CVE-2023-44487.patch \ " inherit siteinfo update-rc.d useradd systemd -- cgit v1.2.3-54-g00ecf