Nginx security advisory (CVE-2013-2028)

Re:Nginx security advisory (CVE-2013-2028) by pavs on Tuesday May 07, 2013 @10:50AM (#5668398)

Just for reference for others who might be interested:

I had to install this public key from ubuntu server:

sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys ABF5BD827BD9BF62

Had to remove nginx-full and nginx-common.

Then install nginx: apt-get install nginx

Even though I told the installer to keep the default config (which it did) but over-written /etc/nginx/conf.d/default.conf The only change I had to make was port number, since I am using varnish changed my port to 8080 for nginx. Restarted nginx.

  nginx version: nginx/1.4.1

Thanks for the help!

[ Parent | on HN ]

Re:Nginx security advisory (CVE-2013-2028) by lmcnearney on Tuesday May 07, 2013 @02:07PM (#5669680)

Another note: Packages provided by Ubuntu use /etc/nginx/sites-available/ and /etc/nginx/sites-available/ for storing site configs but the package directly from Nginx stores configs in /etc/nginx/conf.d/.

[ Parent | on HN ]

Re:Nginx security advisory (CVE-2013-2028) by intrawl on Tuesday May 07, 2013 @05:25PM (#5670907)

Thanks for pointing this out. I spent a little while trying to figure out why my configuration wasn't being recognized.

[ Parent | on HN ]

Re:Nginx security advisory (CVE-2013-2028) by ericcholis on Tuesday May 07, 2013 @11:20AM (#5668539)

I had the same trouble, pretty seamless upgrade otherwise.

[ Parent | on HN ]