A new nginx package with the fix for the CVE-2021-23017 within CentOS 6 extended lifecycle support has been scheduled for gradual rollout from our production repository.

Rollout slot: 1

Rolled out to: 1%

ETA for 100% rollout: June, 7

Changelog

• Fix off-by-one heap write vulnerability (CVE-2021-23017)

Update command

yum update nginx*

Immediate update (via bypass)

yum update nginx* --enablerepo=ELS6-rollout-1-bypass