Update nginx to address DoS CVEs
The current embedded version of nginx is vulnerable to multiple new DoS attacks. A new version has been released to address these specific CVEs. nginx was updated on 2019-08-13 to the stable release of 1.16.1 and mainline release of 1.17.3 with fixes for vulnerabilities in HTTP/2 (CVE-2019-9511, CVE-2019-9513, CVE-2019-9516).
nginx rates these CVEs as medium and low severity, but Tenable Security Center rates the findings as a high.
https://nginx.org/en/security_advisories.html
https://www.tenable.com/plugins/nessus/127907
As a user of gitlab within a hardened and scanned environment, I would like to remediate this vulnerability on our gitlab installation.
Activity
Thanks for submitting this issue. Since GitLab's development now happens in a single codebase, the canonical GitLab issue tracker is now at https://gitlab.com/gitlab-org/gitlab/issues.
This issue will automatically be moved there.
added automation:to-be-locked in GitLab FOSS label
moved from gitlab-foss#67355 (moved)
mentioned in issue #32197 (closed)
I believe NGINX 1.16.1 was already shipped in GitLab 12.2: omnibus-gitlab!3525 (merged)