Re: CVEs for nginx

[Igor Sysoev <igor () sysoev ru>]

On Mon, Nov 23, 2009 at 12:12:53PM +0100, Jan Lieskovsky wrote:

> Hi Igor,
>
> Igor Sysoev wrote:
>  > As I far I know - no.
>
>    Josh, could you allocate one then?
>
>   > This bug was fixed in 0.8.17 and 0.7.63:
> > Changes with nginx 0.8.17                                        28 Sep 2009
> >
> >     *) Security: now "/../" are disabled in "Destination" request header
> >        line.
> >
> > Changes with nginx 0.7.63                                        26 Oct 2009
> >
> >     *) Security: now "/../" are disabled in "Destination" request header
> >        line.
> >
> > There is no patch, however, I can created it for you.
>
>    That would be perfect.

The patch attached.


-- 
Igor Sysoev
http://sysoev.ru/en/

Attachment: patch.dest.txt
Description: