6 ms·
Nginx Security Advisory
- sschueller 3y agoInteresting, this is just an hour before the core dev quit because of disagreements on how security is managed at F5. https://news.ycombinator.com/item?id=39373327 https://news.ycombinator.com/item?id=39373327
- justsomehnguy 3y agoThanks. Guess we are in some interesting times, again.
- the_mitsuhiko 3y agoAnd to be clear, the disagreement appears to be that he did not want the CVE to be assigned.
- ArchOversight 3y agoThis has been an issue in the past, where NGINX disagreed with a CVE being assigned, but a CVE is the easiest way to get a vulnerability fixed across the ecosystem and in the distributions that distribute NGINX. Each time something is silently fixed it takes much longer and is much harder to actually get the fix approved/backported/whatever is necessary to get it fixed.
- deleted 3y ago[deleted]
- braiamp 3y agoExcept that no one is shipping with QUIC enabled. It's marked as experimental, so if you are deploying on prod you are asking for it.
- ArchOversight 3y agoAsking for what?
- KomoD 3y agosource?
- kayfox 3y agohttps://news.ycombinator.com/item?id=39374312 https://news.ycombinator.com/item?id=39374312 MegaZone is part of the F5 Security Incident Response Team.
- dsr_ 3y agoAnd just so that he doesn't have to explain it: yes, it's his legal name, and yes, it's a mononym. Source: we were coworkers before F5.
- theogravity 3y agoHow does filling in the last name (or first) on forms work when mononyms are involved?
- darylteo 3y agoIf it's anything like how the Indonesians do it, <name> <name>
- MZMegaZone 3y agoShort answer: Badly. Long answer: Most DBs key on lastname, so MegaZone is my last name, officially, and I have no first name. Then I leave the first name blank if it'll let me, but more often I need to put something in there - so these days I use 'MZ' as that's what I have people call me. I used to use 'Mr', and I still need to use that on some government forms so everything will match up.
- theogravity 3y agoOn official gov documents like ID / Passport, does it read: First Name: Mr Last Name: MegaZone based on what you stated? I figure that gov forms would always require a first / last entry.
- geocrasher 3y agoStill being investigated apparently. From what's known, they haven't been labeled as RCE's at least.
- k00shball 3y agoIt is not still being investigated. The issues are understood. Patched versions are released.
- mise_en_place 3y agoWill this affect http/2 as well?
- will_wright 3y agoI'm a novice at nginx and using modules. how do I figure out if the nginx docker images that I use are effected by this? it looks like the default image uses `debian:bookworm-slim`. is it safe to assume that the compiled version in that upstream image isn't using any additional modules? > The issues affect nginx compiled with the ngx_http_v3_module (not compiled by default) if the "quic" option of the "listen" directive is used in a configuration file.
- thresh 3y agoHi! The official nginx docker images ship with HTTP3 module enabled - and we have released the updated ones earlier today - so please update to stay secure. You can also launch something like: $ docker run -ti --rm nginx:latest nginx -V to check which modules are compiled in to the binary you're running. Thanks!
- occams_chainsaw 3y agoWhy are they enabled by default while this page says otherwise?: https://my.f5.com/manage/s/article/K000138444 https://my.f5.com/manage/s/article/K000138444 Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental.
- silverwind 3y agoBecause they are not so "official" maybe?
- tristor 3y agoThis seems like mostly a non-issue, since this module isn't compiled by default. I guess it's good to fix it regardless, but it seems unnecessary to issue a security advisory/CVE for this. HTTP/3 is an experimental feature in nginx that isn't built by default and isn't included in most distribution builds.