Nginx update broke Nextcloud

1

It appears a recent nginx update, 1.18.0-6ubuntu14.19 to patch CVE-2026-42533, broke Nextcloud [for me?].

MIAB uses variables to construct the FastCGI filename, which nginx passes to PHP-FPM with a corrupted path “/usr/local/lib/owncloud//cloud/ind” instead of “/usr/local/lib/owncloud/index.php”; this means your Nextcloud instance shows “File not found” coupled with people complaining their shared calendars are broken this morning :slight_smile:

1 Like
2

That explains some of the many errors I’ve been seeing this morning.

3

After re-running the install script (cd mailinabox; setup/start.sh or just mailinabox), the problem was resolved for me. I don’t know if that’s because a package was updated again or if a broken configuration file was re-written.

1 Like
4

Looks like a fresh setup run pulled down and installed a newer nginx revision (.20); They backed out of the CVE patch; I imagine we weren’t the only victims here!

5

I ran “apt upgrade” this morning and now I have this issue with Nextcloud calendars. Reinstalled mailinabox with setup.sh twice and nextcloud still broken (File not found).

nginx -v shows nginx/1.18.0 (ubuntu) and “apt clean, apt upgrade” has no new changes.

FWIW USN-8563-3: nginx vulnerability | Ubuntu security notices | Ubuntu
They did release a better version of the fix but the default nginx version for Ubuntu 22.04 remains at: 1.18.0-6ubuntu14.19

Any suggestions welcome.

Progress: Ubuntu nginx 1.18.0-6ubuntu14.19 breaks Nextcloud/DAV routes using numbered regex captures · Issue #2597 · mail-in-a-box/mailinabox · GitHub

Thanks
Geoffrey

6

.19 was superseded with .20 (Ubuntu – Details of package nginx in jammy-updates).

Try:

sudo apt update && sudo apt upgrade -y

Then to confirm:

dpkg-query -W -f='${Package}\t${Version}\n' nginx nginx-core

“apt clean” without an “apt update” likely just reinstalled without refreshing the indexes.

7

I did all those apt steps, multiple times.
The command “dpkg-query -W -f=‘${Package}\t${Version}\n’ nginx nginx-core” returns:
nginx 1.18.0-6ubuntu14.19
nginx-core 1.18.0-6ubuntu14.19

I made the changes outlined in the GitHub issue I posted above as a test and the NextCloud calendar works now. That seems to be the better solution, it resolves the underlying nginx CVE issue?

UPDATE: looks like a moving target, I see 14.20 is set as the default now for Jammy (as you said) AND someone is still working on it. Up to USN-8563-4 now…
https://ubuntu.com/security/notices/USN-8563-4

Thanks

1 Like
8

I ran ‘sudo mailinabox’ and it fixed the nextcloud for me yesterday :slight_smile:
Thanks for all your great work Josh… appreciate you.

9

My nginx version remains at “nginx 1.18.0-6ubuntu14.19” and the original issue still exists.
My VM is using NZ mirrors /etc/apt/sources.list: //nz.archive.ubuntu.com

So I appended the Ubuntu global repo to /etc/apt/sources.list: //security.ubuntu.com

and ran apt clean & apt update & apt upgrade
Now I get the new nginx release:
dpkg-query -W -f=‘${Package}\t${Version}\n’ nginx nginx-core
’
nginx 1.18.0-6ubuntu14.20
nginx-core 1.18.0-6ubuntu14.20

I restored the original mailinabox/conf/nginx-primaryonly.conf (undo changes made for #2597 which is also fixs this issue)
and my calendars are back :slight_smile:

1 Like