A vulnerability in NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer, has been resolved in the Junos Space Security Director Insights 21.3R1 release by updating third party software included with Junos Space Security Director Insights or by fixing vulnerabilities found during external security research.

This issue affects Juniper Networks Junos Space Security Director Insights versions prior to 21.3R1.

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

This issue was discovered during external security research.

This issue has been assigned  CVE-2019-20372 .

The following software releases have been updated to resolve these specific issues: Junos Space Security Director Insights 21.3R1, and all subsequent releases.

This issue is being tracked as  1613923 .

There are no known workarounds for this issue.

To reduce the risk of exploitation of this issue, use access lists or firewall filters to limit access to the device to only trusted administrative networks, hosts and users.