4 ms·
The patch described on the vulnerability page worked 1-to-1 for in two nginx versions I fixed. But in nginx 1.20 in ./src/core/ngx_resolver.c the second replace
by superkuh 5y ago
The patch described on the vulnerability page worked 1-to-1 for in two nginx versions I fixed. But in nginx 1.20 in ./src/core/ngx_resolver.c the second replacement does not match the existing if (len == -1){contents} and I had to remove some extra bits based on what seemed right it manually.
- artifact_44 5y agoUh. That sounds.. kinda bad in the context of something like.... DNS.
- luismerino 5y agoYou might want to go with the official fix: https://nginx.org/download/patch.2021.resolver.txt https://nginx.org/download/patch.2021.resolver.txt
- superkuh 5y agoThanks! I'll recompile with that now that it is out.