Nginx Security Advisory

[sschueller]

Interesting, this is just an hour before the core dev quit because of disagreements on how security is managed at F5.

https://news.ycombinator.com/item?id=39373327

[the_mitsuhiko]

And to be clear, the disagreement appears to be that he did not want the CVE to be assigned.

[justsomehnguy]

Thanks. Guess we are in some interesting times, again.

[tristor]

This seems like mostly a non-issue, since this module isn't compiled by default. I guess it's good to fix it regardless, but it seems unnecessary to issue a security advisory/CVE for this. HTTP/3 is an experimental feature in nginx that isn't built by default and isn't included in most distribution builds.

[geocrasher]

Still being investigated apparently. From what's known, they haven't been labeled as RCE's at least.

[k00shball]

It is not still being investigated. The issues are understood. Patched versions are released.

[will_wright]

I'm a novice at nginx and using modules. how do I figure out if the nginx docker images that I use are effected by this? it looks like the default image uses `debian:bookworm-slim`. is it safe to assume that the compiled version in that upstream image isn't using any additional modules?

> The issues affect nginx compiled with the ngx_http_v3_module (not compiled by default) if the "quic" option of the "listen" directive is used in a configuration file.

[thresh]

Hi!

The official nginx docker images ship with HTTP3 module enabled - and we have released the updated ones earlier today - so please update to stay secure.

You can also launch something like: $ docker run -ti --rm nginx:latest nginx -V

to check which modules are compiled in to the binary you're running.

Thanks!

[mise_en_place]

Will this affect http/2 as well?

[k00shball]

This is limited to just HTTP/3.