Nginx Security Advisory (opens in new tab)

(mailman.nginx.org)

144 pointsTimWolla2y ago25 comments

25 comments

sschueller2y ago

Interesting, this is just an hour before the core dev quit because of disagreements on how security is managed at F5.

https://news.ycombinator.com/item?id=39373327

the_mitsuhiko2y ago

And to be clear, the disagreement appears to be that he did not want the CVE to be assigned.

ArchOversight2y ago

This has been an issue in the past, where NGINX disagreed with a CVE being assigned, but a CVE is the easiest way to get a vulnerability fixed across the ecosystem and in the distributions that distribute NGINX.

Each time something is silently fixed it takes much longer and is much harder to actually get the fix approved/backported/whatever is necessary to get it fixed.

2 more replies

KomoD2y ago

source?

1 more reply

justsomehnguy2y ago

Thanks. Guess we are in some interesting times, again.

tristor2y ago

This seems like mostly a non-issue, since this module isn't compiled by default. I guess it's good to fix it regardless, but it seems unnecessary to issue a security advisory/CVE for this. HTTP/3 is an experimental feature in nginx that isn't built by default and isn't included in most distribution builds.

geocrasher2y ago

Still being investigated apparently. From what's known, they haven't been labeled as RCE's at least.

k00shball2y ago

It is not still being investigated. The issues are understood. Patched versions are released.

will_wright2y ago

I'm a novice at nginx and using modules. how do I figure out if the nginx docker images that I use are effected by this? it looks like the default image uses `debian:bookworm-slim`. is it safe to assume that the compiled version in that upstream image isn't using any additional modules?

> The issues affect nginx compiled with the ngx_http_v3_module (not compiled by default) if the "quic" option of the "listen" directive is used in a configuration file.

thresh2y ago

Hi!

The official nginx docker images ship with HTTP3 module enabled - and we have released the updated ones earlier today - so please update to stay secure.

You can also launch something like: $ docker run -ti --rm nginx:latest nginx -V

to check which modules are compiled in to the binary you're running.

Thanks!

occams_chainsaw2y ago

Why are they enabled by default while this page says otherwise?: https://my.f5.com/manage/s/article/K000138444

  Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental.

1 more reply

mise_en_place2y ago

Will this affect http/2 as well?

k00shball2y ago

This is limited to just HTTP/3.

braiamp2y ago

To just the experimental QUIC element of HTTP/3.

j / k navigate · click thread line to collapse

25 comments

sschueller2y ago

Interesting, this is just an hour before the core dev quit because of disagreements on how security is managed at F5.

https://news.ycombinator.com/item?id=39373327

the_mitsuhiko2y ago

And to be clear, the disagreement appears to be that he did not want the CVE to be assigned.

ArchOversight2y ago

Each time something is silently fixed it takes much longer and is much harder to actually get the fix approved/backported/whatever is necessary to get it fixed.

2 more replies

KomoD2y ago

source?

1 more reply

justsomehnguy2y ago

Thanks. Guess we are in some interesting times, again.

tristor2y ago

geocrasher2y ago

Still being investigated apparently. From what's known, they haven't been labeled as RCE's at least.

k00shball2y ago

It is not still being investigated. The issues are understood. Patched versions are released.

will_wright2y ago

> The issues affect nginx compiled with the ngx_http_v3_module (not compiled by default) if the "quic" option of the "listen" directive is used in a configuration file.

thresh2y ago

Hi!

The official nginx docker images ship with HTTP3 module enabled - and we have released the updated ones earlier today - so please update to stay secure.

You can also launch something like: $ docker run -ti --rm nginx:latest nginx -V

to check which modules are compiled in to the binary you're running.

Thanks!

occams_chainsaw2y ago

Why are they enabled by default while this page says otherwise?: https://my.f5.com/manage/s/article/K000138444

  Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental.

1 more reply

mise_en_place2y ago

Will this affect http/2 as well?

k00shball2y ago

This is limited to just HTTP/3.

braiamp2y ago

To just the experimental QUIC element of HTTP/3.

j / k navigate · click thread line to collapse