Kevin Daudt authored 2 years ago and Jakub Jirutka committed 2 years ago

CVE-2021-3618 is an application layer protocol content confusion attack,
affecting multiple applications.

According to [redhat][0], nginx addressed this in hg:ec1071830799[1] or
git:173f16f736c10[2] in mainline, but this has not been backported to a
stable version yet.

Backport this fix ourselves.

Fixes #13737

[0]:https://bugzilla.redhat.com/show_bug.cgi?id=1975623
[1]:http://hg.nginx.org/nginx/rev/ec1071830799
[2]:https://github.com/nginx/nginx/commit/173f16f736c10eae46cd15dd861b04b82d91a37a