Nginx security update

Re:Nginx security update by samwillis on Tuesday July 09, 2013 @09:10AM (#6012445)

Am I right in interpreting this as only a vulnerability if you use Nginx to proxy to an untrusted server (i.e. not yours) where specially formatted responses can compromise your Nginx?

It would seem to me that this is a particularly rare use case of nginx?

I suppose shared web hosts and services like CloudFlare are the types of implementation that may be affected.

[ Parent | on HN ]

Re:Nginx security update by DrJokepu on Tuesday July 09, 2013 @09:14AM (#6012463)

Yes but this can be exploited if a trusted backend server (which is much more common) gets compromised. Basically if you have nginx in front of Node and you manage to execute arbitrary code in Node you could use this as an attack vector to compromise nginx which could act as a front-end to a whole lot of other things.

[ Parent | on HN ]

Re:Nginx security update by byroot on Tuesday July 09, 2013 @09:14AM (#6012460)

Yes, you interpret it correctly.

It's not that common, but I know at least an app using nginx in that way, and it was performing very well.

[ Parent | on HN ]