Inquiry about Nginx version in Snap Store Proxy snap and CVE-2021-23017

[YCn]

Hello ,

I’m currently managing a network environment where we utilize the Snap Store Proxy snap for caching Snap Store downloads. Recently, I became aware of the CVE-2021-23017 vulnerability affecting Nginx, which is bundled with the Snap Store Proxy snap.

As part of our security measures, I need to verify the status of the Nginx version included in the Snap Store Proxy snap. According to the information provided by Canonical, we are using version 2.28 of the Snap Store Proxy snap. However, I couldn’t find specific details about the version of Nginx bundled with it and whether it has been patched to address CVE-2021-23017.

Could someone provide information please about the version of Nginx included in the Snap Store Proxy snap version 2.28? Additionally, I’m interested in knowing if this version of Nginx has been patched to mitigate the CVE-2021-23017 vulnerability.

thank you

[suligap]

Hi, this snap contains nginx-light=1.18.0-6ubuntu14.4 specifically. According to http://changelogs.ubuntu.com/changelogs/pool/main/n/nginx/nginx_1.18.0-6ubuntu14.4/changelog CVE-2021-23017 is patched.

[ogra]

Also see this post:

Snap Store Proxy - how to update nginx version?

Hello, please excuse what is probably a really dumb question, but how do I update the version of nginx (1.18.0) on my locally installed snap store proxy? I see latest version is 1.24, and the installed version with the snap-store-proxy (v1.18.0) is giving me a security headache on my network due to a ‘high’ Nessus scanner finding of: 1-Byte Memory Overwrite. Unfortunately on our network we cannot have any ‘critical’ or ‘high’ issues, so this is causing me some concern. I tried manually updatin…

It explains how to check package versions bundled inside the proxy snap for future reference…