Re: CVEs for nginx

[Jan Lieskovsky <jlieskov () redhat com>]

Hi Igor,

Igor Sysoev wrote:
> As I far I know - no.

  Josh, could you allocate one then?

 > This bug was fixed in 0.8.17 and 0.7.63:
> Changes with nginx 0.8.17                                        28 Sep 2009
>
>     *) Security: now "/../" are disabled in "Destination" request header
>        line.
>
> Changes with nginx 0.7.63                                        26 Oct 2009
>
>     *) Security: now "/../" are disabled in "Destination" request header
>        line.
>
> There is no patch, however, I can created it for you.

  That would be perfect.

Thanks && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team