ELA-1547-1 nginx security update

Package	nginx
Version	1.10.3-1+deb9u9 (stretch), 1.14.2-2+deb10u6 (buster)
Related CVEs	CVE-2024-7347 CVE-2024-33452 CVE-2025-23419

Multiple vulnerabilities were found in nginx a popular webserver.

CVE-2024-7347

A vulnerability was found in the ngx_http_mp4_module,
This vulnerability might allow an attacker to over-read NGINX
worker memory resulting in its termination, using a specially crafted mp4 file.

CVE-2024-33452

A vulnerability was found in the lua-nginx-module.
This vulnerability allows a remote attacker to conduct HTTP request smuggling
via a crafted HEAD request.

CVE-2025-23419

When multiple server blocks are configured to share the same IP address and port,
an attacker can use session resumption to bypass client certificate authentication
requirements on these servers.
This vulnerability arises when TLS Session Tickets are used and/or the SSL session cache
are used in the default server and the default server is performing
client certificate authentication

For Debian 10 buster, these problems have been fixed in version 1.14.2-2+deb10u6.

For Debian 9 stretch, these problems have been fixed in version 1.10.3-1+deb9u9.

We recommend that you upgrade your nginx packages.

Further information about Extended LTS security advisories can be found in the dedicated section of our website.