4 ms·
Is there a better list of fixed versions for E.G. Apache / Lighttpd (n/a No http/2 support) / Nginx?
by mjevans 7y ago
Is there a better list of fixed versions for E.G. Apache / Lighttpd (n/a No http/2 support) / Nginx?
- m11r 7y agoFor nginx, versions 1.16.1+ and 1.17.3+ from upstream fix at least three of the vulnerabilities (CVE-2019-9511, CVE-2019-9513, CVE-2019-9516), however if you use a version provided by a distribution’s repositories (e.g., nginx 1.16 included with Ubuntu 18.04 LTS) you’ll need to watch for those security advisories and fixes separately which may have different version numbers due to the backporting.
- rdli 7y agoThis is addressed in Envoy 1.11.1 (https://www.envoyproxy.io/docs/envoy/v1.11.1/intro/version_history https://www.envoyproxy.io/docs/envoy/v1.11.1/intro/version_h...) and Ambassador 0.75 (https://blog.getambassador.io/multiple-http-2-vulnerabilities-in-envoy-proxy-59351babb3aa https://blog.getambassador.io/multiple-http-2-vulnerabilitie...).