buffer overflow, null pointer deref in nginx rtmp module

[Sven Neuhaus]

The relevant package name is libnginx-mod-rtmp.

There is a fix for a buffer overrun in the nginx RTMP module:

https://github.com/arut/nginx-rtmp-module/commit/2f2db811f8533782dfbef57fdb14f4737e2be55a

It should be applied to this package.

You should also fix the null pointer dereference as done with this commit

https://github.com/arut/nginx-rtmp-module/commit/23e1873aa62acb58b7881eed2a501f5bf35b82e9

[Steve Beattie (sbeattie)]

Thanks for the report. Have CVEs been assigned for either of these issues?

Given that the commits are public, I'm opening this bug up as public as well.

[Thomas Ward (teward)]

Debdiffs prepared for Security Team review / inclusion. Note that the specific module is embedded in debian/modules/... so non-standard patching (aka non-Quilt-patching) was utilized.

Upstream patches were {UPSTREAM_URL}.patch to get the patch files that were applied.j

[Leonidas S. Barbosa (leosilvab)]

Hello Thomas,

I'm from security team and will handle it and let this bug know when it is done. thanks!

[Launchpad Janitor (janitor)]

This bug was fixed in the package nginx - 1.18.0-6ubuntu14.6

---------------
nginx (1.18.0-6ubuntu14.6) jammy-security; urgency=medium

  * SECURITY UPDATE: null pointer dereference in nginx-rtmp-module.
    - debian/modules/rtmp/ngx_rtmp_amf.c patched with upstream
      commits.
  * SECURITY UPDATE: buffer overrun in nginx-rtmp-module
    - debian/modules/rtmp/ngx_rtmp_handler.c patched with upstream
      commits.
  * Closes LP: #1977718

 -- Thomas Ward <email address hidden> Fri, 14 Feb 2025 13:40:46 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package nginx - 1.18.0-0ubuntu1.7

---------------
nginx (1.18.0-0ubuntu1.7) focal-security; urgency=medium

  * SECURITY UPDATE: null pointer dereference in nginx-rtmp-module.
    - debian/modules/rtmp/ngx_rtmp_amf.c patched with upstream
      commits.
  * SECURITY UPDATE: buffer overrun in nginx-rtmp-module
    - debian/modules/rtmp/ngx_rtmp_handler.c patched with upstream
      commits.
  * Closes LP: #1977718

 -- Thomas Ward <email address hidden> Fri, 14 Feb 2025 13:44:44 -0500