4 ms·
>Was the code in question included in stable releases? If not, I might agree that assigning CVEs are not helpful. F5 employee says code the was marked as "expe
by jasode 3y ago
>Was the code in question included in stable releases?
If not, I might agree that assigning CVEs are not helpful.
F5 employee says code the was marked as "experimental" but the issue is that customers were running it in production:
https://news.ycombinator.com/item?id=39378523 https://news.ycombinator.com/item?id=39378523
https://news.ycombinator.com/item?id=39379984 https://news.ycombinator.com/item?id=39379984
It's worth going through that entire thread and Ctrl+F search userid "MZMegaZone" to get F5's rationale for assigning a CVE.
Why are some customers running experimental code in production?!? I can only assume they do it to solve a problem and take early advantage of a new feature that doesn't exist in the stable release.
- kuschku 3y agoApparently F5 shipped it in production in their proprietary version, while it was not compiled into the free version. So technically the CVE should be filed against NGINX Plus, not nginx ;)