Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Nginx Security Advisory

mailman.nginx.org

Post reply on HN
Print view View original

11–20 of 27 posts

Re: Nginx Security Advisory

#11

Post by dsr_ »

kayfox wrote: post #10
KomoD wrote: post #8

Earlier quoted context omitted.

source?

https://news.ycombinator.com/item?id=39374312 MegaZone is part of the F5 Security Incident Response Team.

And just so that he doesn't have to explain it: yes, it's his legal name, and yes, it's a mononym.

Source: we were coworkers before F5.

Re: Nginx Security Advisory

#12

Post by [deleted] »

ArchOversight wrote: post #7
the_mitsuhiko wrote: post #6

Earlier quoted context omitted.

And to be clear, the disagreement appears to be that he did not want the CVE to be assigned.

This has been an issue in the past, where NGINX disagreed with a CVE being assigned, but a CVE is the easiest way to get a vulnerability fixed across the ecosystem and in the distributions that distribute NGINX. Each time something is silently fixed it takes much longer and is much harder to actually get the fix approved/backported/whatever is necessary to get it fixed.

[deleted]

Re: Nginx Security Advisory

#13

Post by will_wright »

I'm a novice at nginx and using modules. how do I figure out if the nginx docker images that I use are effected by this? it looks like the default image uses `debian:bookworm-slim`. is it safe to assume that the compiled version in that upstream image isn't using any additional modules?

> The issues affect nginx compiled with the ngx_http_v3_module (not compiled by default) if the "quic" option of the "listen" directive is used in a configuration file.

Re: Nginx Security Advisory

#14

Post by thresh »

will_wright wrote: post #13

I'm a novice at nginx and using modules. how do I figure out if the nginx docker images that I use are effected by this? it looks like the default image uses `debian:bookworm-slim`. is it safe to assume that the compiled version in that upstream image isn't using any additional modules? > The issues affect nginx compiled with the ngx_http_v3_module (not compiled by default) if the "quic" option of the "listen" direct…

Hi!

The official nginx docker images ship with HTTP3 module enabled - and we have released the updated ones earlier today - so please update to stay secure.

You can also launch something like: $ docker run -ti --rm nginx:latest nginx -V

to check which modules are compiled in to the binary you're running.

Thanks!

Re: Nginx Security Advisory

#15

Post by tristor »

This seems like mostly a non-issue, since this module isn't compiled by default. I guess it's good to fix it regardless, but it seems unnecessary to issue a security advisory/CVE for this. HTTP/3 is an experimental feature in nginx that isn't built by default and isn't included in most distribution builds.

Re: Nginx Security Advisory

#17

Post by occams_chainsaw »

thresh wrote: post #14
will_wright wrote: post #13

I'm a novice at nginx and using modules. how do I figure out if the nginx docker images that I use are effected by this? it looks like the default image uses `debian:bookworm-slim`. is it safe to assume that the compiled version in that upstream image isn't using any additional modules? > The issues affect nginx compiled with the ngx_http_v3_module (not compiled by default) if the "quic" option of the "listen" direct…

Hi! The official nginx docker images ship with HTTP3 module enabled - and we have released the updated ones earlier today - so please update to stay secure. You can also launch something like: $ docker run -ti --rm nginx:latest nginx -V to check which modules are compiled in to the binary you're running. Thanks!

Why are they enabled by default while this page says otherwise?: https://my.f5.com/manage/s/article/K000138444

  Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental.

Re: Nginx Security Advisory

#18

Post by silverwind »

occams_chainsaw wrote: post #17
thresh wrote: post #14

Earlier quoted context omitted.

Hi! The official nginx docker images ship with HTTP3 module enabled - and we have released the updated ones earlier today - so please update to stay secure. You can also launch something like: $ docker run -ti --rm nginx:latest nginx -V to check which modules are compiled in to the binary you're running. Thanks!

Why are they enabled by default while this page says otherwise?: https://my.f5.com/manage/s/article/K000138444 Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental.

Because they are not so "official" maybe?

Re: Nginx Security Advisory

#20

Post by theogravity »

dsr_ wrote: post #11
kayfox wrote: post #10

Earlier quoted context omitted.

https://news.ycombinator.com/item?id=39374312 MegaZone is part of the F5 Security Incident Response Team.

And just so that he doesn't have to explain it: yes, it's his legal name, and yes, it's a mononym. Source: we were coworkers before F5.

How does filling in the last name (or first) on forms work when mononyms are involved?
Post reply on HN