Nginx Security Advisory

Re:Nginx Security Advisory by will_wright on Wednesday February 14, 2024 @06:33PM (#39377095)

I'm a novice at nginx and using modules. how do I figure out if the nginx docker images that I use are effected by this? it looks like the default image uses `debian:bookworm-slim`. is it safe to assume that the compiled version in that upstream image isn't using any additional modules?

> The issues affect nginx compiled with the ngx_http_v3_module (not compiled by default) if the "quic" option of the "listen" directive is used in a configuration file.

[ Parent | on HN ]

Re:Nginx Security Advisory by thresh on Wednesday February 14, 2024 @07:08PM (#39377390)

Hi!

The official nginx docker images ship with HTTP3 module enabled - and we have released the updated ones earlier today - so please update to stay secure.

You can also launch something like: $ docker run -ti --rm nginx:latest nginx -V

to check which modules are compiled in to the binary you're running.

Thanks!

[ Parent | on HN ]

Re:Nginx Security Advisory by occams_chainsaw on Wednesday February 14, 2024 @08:12PM (#39377933)

Why are they enabled by default while this page says otherwise?: https://my.f5.com/manage/s/article/K000138444

  Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental.

[ Parent | on HN ]

Re:Nginx Security Advisory by silverwind on Wednesday February 14, 2024 @08:35PM (#39378089)

Because they are not so "official" maybe?

[ Parent | on HN ]