NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks
-
NGINX has released versions 1.30.6 and 1.31.7 on October 14, addressing five vulnerabilities in total. Notably, one of these flaws has existed in every release since May 2005.
F5, the company maintaining NGINX, reports that three of the issues are memory bugs capable of crashing a worker process or potentially enabling an attacker to execute code. Each of these three requires a specific configuration to be exploitable.
A fourth vulnerability allows an attacker to forge a TLS session that could bypass client-certificate checks. The article does not provide specific CVE identifiers for any of the flaws.
Administrators running affected NGINX deployments should upgrade to 1.30.6 or 1.31.7 as soon as possible.
Source: The Hacker News
Has your organization already applied the update, or are you waiting on internal testing before rolling it out?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login