3 ms·
Yikes this is pretty bad. Many log files (wrongly) include things like form fields including passwords and auth tokens.
by 3pt14159 10y ago
Yikes this is pretty bad. Many log files (wrongly) include things like form fields including passwords and auth tokens.
- 0x0 10y agoIf you have www-data access you can probably grab those from memory. This vulnerability is about escalating to root. But if all your juicy data is already available to / passing through your nginx, then this patch isn't doing much to improve your situation.
- therein 10y agoExcept one requires the attacker to read from the processes memory in an organized way for an extended amount of time to snoop data while the other just puts its conveniently onto your disk.