Bug#730012: nginx: CVE-2013-4547

2013-11-25 Thread Kevin Price
Hi Christos: Am 25.11.2013 21:07, schrieb Christos Trochalakis: > We are going to backport 1.4.4 as soon as it migrates to testing. Thanks even more. :) FYI: One serious data retention issue is a prime reason for using nginx >= 1.3.7, thus bpo: OCSP stapling. (rfc4366) So presumably there are ma

Bug#730012: nginx: CVE-2013-4547

2013-11-25 Thread Christos Trochalakis
On Mon, Nov 25, 2013 at 08:37:20PM +0100, Kevin Price wrote: Hi! Thanks a lot for fixing this issue! Is there a chance that the still vulnerable wheezy-backports will soon be either patched or updated? (I know, security does not include bpo.) patch: http://nginx.org/download/patch.2013.space.tx

Bug#730012: nginx: CVE-2013-4547

2013-11-25 Thread Kevin Price
Hi! Thanks a lot for fixing this issue! Is there a chance that the still vulnerable wheezy-backports will soon be either patched or updated? (I know, security does not include bpo.) patch: http://nginx.org/download/patch.2013.space.txt update: 1.4.4 or 1.5.7 will do. (reference: http://mailman.n

Bug#730012: nginx: CVE-2013-4547

2013-11-20 Thread Christos Trochalakis
On Wed, Nov 20, 2013 at 07:09:07AM +0100, Salvatore Bonaccorso wrote: Package: nginx Severity: grave Tags: security upstream patch Hi, the following vulnerability was published for nginx. CVE-2013-4547[0]: security restrictions bypass If you fix the vulnerability please also make sure to incl

Bug#730012: nginx: CVE-2013-4547

2013-11-19 Thread Salvatore Bonaccorso
Package: nginx Severity: grave Tags: security upstream patch Hi, the following vulnerability was published for nginx. CVE-2013-4547[0]: security restrictions bypass If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog en