Nginx security advisory (CVE-2013-2028)

Re:Nginx security advisory (CVE-2013-2028) by spindritf on Tuesday May 07, 2013 @09:45AM (#5668067)

Use their official repository[1] for the latest stable releases

    deb http://nginx.org/packages/ubuntu/ precise nginx
    deb-src http://nginx.org/packages/ubuntu/ precise nginx

Those are updated very quickly. I haven't timed it but I'm yet to see an advisory before an update is available.

[1] http://wiki.nginx.org/Install#Official_Debian.2FUbuntu_packa...

[ Parent | on HN ]

Re:Nginx security advisory (CVE-2013-2028) by pavs on Tuesday May 07, 2013 @10:50AM (#5668398)

Just for reference for others who might be interested:

I had to install this public key from ubuntu server:

sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys ABF5BD827BD9BF62

Had to remove nginx-full and nginx-common.

Then install nginx: apt-get install nginx

Even though I told the installer to keep the default config (which it did) but over-written /etc/nginx/conf.d/default.conf The only change I had to make was port number, since I am using varnish changed my port to 8080 for nginx. Restarted nginx.

  nginx version: nginx/1.4.1

Thanks for the help!

[ Parent | on HN ]

Re:Nginx security advisory (CVE-2013-2028) by lmcnearney on Tuesday May 07, 2013 @02:07PM (#5669680)

Another note: Packages provided by Ubuntu use /etc/nginx/sites-available/ and /etc/nginx/sites-available/ for storing site configs but the package directly from Nginx stores configs in /etc/nginx/conf.d/.

[ Parent | on HN ]

Re:Nginx security advisory (CVE-2013-2028) by intrawl on Tuesday May 07, 2013 @05:25PM (#5670907)

Thanks for pointing this out. I spent a little while trying to figure out why my configuration wasn't being recognized.

[ Parent | on HN ]

Re:Nginx security advisory (CVE-2013-2028) by ericcholis on Tuesday May 07, 2013 @11:20AM (#5668539)

I had the same trouble, pretty seamless upgrade otherwise.

[ Parent | on HN ]

Re:Nginx security advisory (CVE-2013-2028) by Shorel on Tuesday May 07, 2013 @10:35AM (#5668332)

Still no raring package.

It seems I'm stuck with 1.2.6 for the time being.

[ Parent | on HN ]

Re:Nginx security advisory (CVE-2013-2028) by ab on Wednesday May 08, 2013 @06:18AM (#5673393)

Not sure what the schedule looks like in general, but last night I waited ~10 minutes after the advisory watching the packages show up one by one. Still faster than any other source, of course.

[ Parent | on HN ]