Nginx Security Advisory
mailman.nginx.org
Nginx Security Advisory
1–10 of 27 posts
Re: Nginx Security Advisory
#2Interesting, this is just an hour before the core dev quit because of disagreements on how security is managed at F5.
Re: Nginx Security Advisory
#3Still being investigated apparently. From what's known, they haven't been labeled as RCE's at least.
Re: Nginx Security Advisory
#4Interesting, this is just an hour before the core dev quit because of disagreements on how security is managed at F5. https://news.ycombinator.com/item?id=39373327
Thanks. Guess we are in some interesting times, again.
Re: Nginx Security Advisory
#5Will this affect http/2 as well?
Re: Nginx Security Advisory
#6Interesting, this is just an hour before the core dev quit because of disagreements on how security is managed at F5. https://news.ycombinator.com/item?id=39373327
And to be clear, the disagreement appears to be that he did not want the CVE to be assigned.
Re: Nginx Security Advisory
#7Interesting, this is just an hour before the core dev quit because of disagreements on how security is managed at F5. https://news.ycombinator.com/item?id=39373327
And to be clear, the disagreement appears to be that he did not want the CVE to be assigned.
This has been an issue in the past, where NGINX disagreed with a CVE being assigned, but a CVE is the easiest way to get a vulnerability fixed across the ecosystem and in the distributions that distribute NGINX.
Each time something is silently fixed it takes much longer and is much harder to actually get the fix approved/backported/whatever is necessary to get it fixed.
Re: Nginx Security Advisory
#8Re: Nginx Security Advisory
#9Will this affect http/2 as well?
This is limited to just HTTP/3.
Re: Nginx Security Advisory
#10Earlier quoted context omitted.
And to be clear, the disagreement appears to be that he did not want the CVE to be assigned.
source?
https://news.ycombinator.com/item?id=39374312
MegaZone is part of the F5 Security Incident Response Team.