CVE-2019-20372
published 2020-01-09CVE-2019-20372: NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized…
PriorityP338medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
14.96%
96.3th percentile
NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | xcode | < 13.0 | 13.0 |
| apple | xcode | — | — |
| canonical | ubuntu_linux | — | — |
| debian | nginx | < nginx 1.16.1-3 (bookworm) | nginx 1.16.1-3 (bookworm) |
| f5 | nginx | < 1.17.7 | 1.17.7 |
| f5 | nginx | >= 0 < 1.16.1-3 | 1.16.1-3 |
| f5 | nginx | >= 0 < 1.16.1-3 | 1.16.1-3 |
| f5 | nginx | >= 0 < 1.16.1-3 | 1.16.1-3 |
| f5 | nginx | >= 0 < 1.16.1-3 | 1.16.1-3 |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
| msrc | cm1_nginx_1.16.1-4_on_cbl_mariner_1.0 | — | — |
| opensuse | leap | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Look for nginx versions 1.17.6 and earlier in HTTP response headers, which are vulnerable to HTTP request smuggling via error_page redirect configurations ↗
- →The vulnerability is only triggered when nginx uses error_page with a URL redirect (302); configurations using named locations (e.g., error_page 401 @401) are NOT vulnerable and can be used as a baseline for safe config detection ↗
- →Detect HTTP request smuggling attempts targeting nginx error_page redirect configurations, particularly in environments where nginx is fronted by a load balancer ↗
- ·Ansible Tower 3.5 and 3.6 are not vulnerable by default because they do not use the error_page variable in nginx configuration, but they ship vulnerable nginx versions (1.14 and 1.16) that could become vulnerable if configuration is modified ↗
- ·Red Hat CloudForms Management Engine 5.9 and 5.10 are not vulnerable by default (no error_page redirect in config) but ship vulnerable nginx versions 1.10 and 1.14 respectively; CloudForms 5.11 does not use nginx at all ↗
- ·Red Hat Quay is not affected because its nginx error_page configuration uses named locations (e.g., error_page 404 /404.html) rather than 302 redirects ↗
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
osv5.3MEDIUM
vendor_debian5.3LOW
vendor_msrc5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Apple
CVE-2019-20372: Xcode 13
vendor_apple·2021-09-20·CVSS 5.3
CVE-2019-20372 [MEDIUM] CVE-2019-20372: Xcode 13
Apple Security Update: About the security content of Xcode 13
Product: Xcode
Version: 13
CVE: CVE-2019-20372
Component: CVE-2019-20372
Ubuntu
nginx vulnerability
vendor_ubuntu·2020-01-15
CVE-2019-20372 nginx vulnerability
Title: nginx vulnerability
Summary: nginx could be made to expose sensitive information over the
network.
USN-4235-1 fixed a vulnerability in nginx. This update provides
the corresponding update for Ubuntu 14.04 ESM.
Original advisory details:
Bert JW Regeer and Francisco Oca Gonzalez discovered that nginx incorrectly
handled certain error_page configurations. A remote attacker could possibly
use this issue to perform HTTP request smuggling attacks and access
resources contrary to expectations.
Instructions: In general, a standard system update will make all the necessary changes.
Microsoft
NGINX before 1.17.7 with certain error_page configurations allows HTTP request smuggling as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is bei
vendor_msrc·2020-01-14·CVSS 5.3
CVE-2019-20372 [MEDIUM] CWE-444 NGINX before 1.17.7 with certain error_page configurations allows HTTP request smuggling as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is bei
NGINX before 1.17.7 with certain error_page configurations allows HTTP request smuggling as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is
Ubuntu
nginx vulnerability
vendor_ubuntu·2020-01-13
CVE-2019-20372 nginx vulnerability
Title: nginx vulnerability
Summary: nginx could be made to expose sensitive information over the network.
Bert JW Regeer and Francisco Oca Gonzalez discovered that nginx incorrectly
handled certain error_page configurations. A remote attacker could possibly
use this issue to perform HTTP request smuggling attacks and access
resources contrary to expectations.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
nginx: HTTP request smuggling in configurations with URL redirect used as error_page
vendor_redhat·2020-01-09·CVSS 5.3
CVE-2019-20372 [MEDIUM] CWE-444 nginx: HTTP request smuggling in configurations with URL redirect used as error_page
nginx: HTTP request smuggling in configurations with URL redirect used as error_page
NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.
Statement: Ansible Tower 3.5 and 3.6 are not vulnerable by default as are not using error_page variable in the nginx configuration. However, Ansible Tower 3.5 and 3.6 are distributing nginx 1.14 and 1.16 vulnerable versions as a dependency and configuration could be modified making it vulnerable.
Red Hat CloudForms Management Engine 5.9 and 5.10 are not vulnerable by default as are not using error_page variable in the nginx configuration. However, both mentioned builds ships
Debian
CVE-2019-20372: nginx - NGINX before 1.17.7, with certain error_page configurations, allows HTTP request...
vendor_debian·2019·CVSS 5.3
CVE-2019-20372 [MEDIUM] CVE-2019-20372: nginx - NGINX before 1.17.7, with certain error_page configurations, allows HTTP request...
NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.
Scope: local
bookworm: resolved (fixed in 1.16.1-3)
bullseye: resolved (fixed in 1.16.1-3)
forky: resolved (fixed in 1.16.1-3)
sid: resolved (fixed in 1.16.1-3)
trixie: resolved (fixed in 1.16.1-3)
GHSA
GHSA-c9vh-3f9g-f2xf: NGINX before 1
ghsa_unreviewed·2022-05-24
CVE-2019-20372 [MEDIUM] CWE-444 GHSA-c9vh-3f9g-f2xf: NGINX before 1
NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.
OSV
CVE-2019-20372: NGINX before 1
osv·2020-01-09·CVSS 5.3
CVE-2019-20372 [MEDIUM] CVE-2019-20372: NGINX before 1
NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-20372 nginx: HTTP request smuggling via error pages in http/ngx_http_special_response.c [epel-all]
bugzilla·2020-01-13·CVSS 5.3
CVE-2019-20372 [MEDIUM] CVE-2019-20372 nginx: HTTP request smuggling via error pages in http/ngx_http_special_response.c [epel-all]
CVE-2019-20372 nginx: HTTP request smuggling via error pages in http/ngx_http_special_response.c [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects
Bugzilla
CVE-2019-20372 nginx: HTTP request smuggling in configurations with URL redirect used as error_page
bugzilla·2020-01-13·CVSS 5.3
CVE-2019-20372 [MEDIUM] CVE-2019-20372 nginx: HTTP request smuggling in configurations with URL redirect used as error_page
CVE-2019-20372 nginx: HTTP request smuggling in configurations with URL redirect used as error_page
nginx before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where nginx is being fronted by a load balancer.
Upstream patch:
https://github.com/nginx/nginx/commit/c1be55f97211d38b69ac0c2027e6812ab8b1b94e
References:
http://nginx.org/en/CHANGES
https://bertjwregeer.keybase.pub/2019-12-10%20-%20error_page%20request%20smuggling.pdf
Discussion:
Created nginx tracking bugs for this issue:
Affects: fedora-all [bug 1790278]
---
Created nginx tracking bugs for this issue:
Affects: epel-all [bug 1790280]
---
We don't use nginx directly in CloudForms 5.11, that came
Bugzilla
CVE-2019-20372 nginx: HTTP request smuggling via error pages in http/ngx_http_special_response.c [fedora-all]
bugzilla·2020-01-13·CVSS 5.3
CVE-2019-20372 [MEDIUM] CVE-2019-20372 nginx: HTTP request smuggling via error pages in http/ngx_http_special_response.c [fedora-all]
CVE-2019-20372 nginx: HTTP request smuggling via error pages in http/ngx_http_special_response.c [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue aff
arXiv
NYU CTF Bench: A Scalable Open-Source Benchmark Dataset for Evaluating LLMs in Offensive Security
arxiv_fulltext·2025-02-18
NYU CTF Bench: A Scalable Open-Source Benchmark Dataset for Evaluating LLMs in Offensive Security
*-0.3in
## Abstract
Large Language Models (LLMs) are being deployed across various domains today. However, their capacity to solve Capture the Flag (CTF) challenges in cybersecurity has not been thoroughly evaluated. To address this, we develop a novel method to assess LLMs in solving CTF challenges by creating a scalable, open-source benchmark database specifically designed for these applications. This database includes metadata for LLM testing and adaptive learning, compiling a diverse range of CTF challenges from popular competitions. Utilizing the advanced function calling capabilities of LLMs, we build a fully automated system with an enhanced workflow and support for external tool calls. Our benchmark dataset and automated framework allow us to evaluate the performance of five LLMs
CTF
Smug-Dino / README
ctf_writeups·2023·CVSS 5.3
[MEDIUM] Smug-Dino / README
# Smug-Dino
> Don't you know it's wrong to smuggle dinosaurs... and other things?
## About the Challenge
We were given a website, and this website have 2 endpoints, `/` and `/hint`. This is what the `/hint` endpoint looks like
Because we know about the web server information (You can find this information on HTTP response header)
Input `nginx` and `1.17.6` and voilà we got the hint
Hmmm, `CVE-2019-***` means this is a CVE related to Nginx considering that the Nginx used in this website is outdated
## How to Solve?
At first, i tried to find any CVEs related to nginx (You can also check the list [here](https://www.cvedetails.com/vulnerability-list/vendor_id-315/product_id-101578/F5-Nginx.html))
And I found this `CVE-2019-20372` and luckily we also found the proof of concept
And t
http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00013.htmlhttp://nginx.org/en/CHANGEShttp://seclists.org/fulldisclosure/2021/Sep/36https://bertjwregeer.keybase.pub/2019-12-10%20-%20error_page%20request%20smuggling.pdfhttps://duo.com/docs/dng-notes#version-1.5.4-january-2020https://github.com/kubernetes/ingress-nginx/pull/4859https://github.com/nginx/nginx/commit/c1be55f97211d38b69ac0c2027e6812ab8b1b94ehttps://security.netapp.com/advisory/ntap-20200127-0003/https://support.apple.com/kb/HT212818https://usn.ubuntu.com/4235-1/https://usn.ubuntu.com/4235-2/http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00013.htmlhttp://nginx.org/en/CHANGEShttp://seclists.org/fulldisclosure/2021/Sep/36https://bertjwregeer.keybase.pub/2019-12-10%20-%20error_page%20request%20smuggling.pdfhttps://duo.com/docs/dng-notes#version-1.5.4-january-2020https://github.com/kubernetes/ingress-nginx/pull/4859https://github.com/nginx/nginx/commit/c1be55f97211d38b69ac0c2027e6812ab8b1b94ehttps://security.netapp.com/advisory/ntap-20200127-0003/https://support.apple.com/kb/HT212818https://usn.ubuntu.com/4235-1/https://usn.ubuntu.com/4235-2/
2020-01-09
Published