3 ms·
And this is the cause of the conflict. Nginx, the open source project, was safe. No CVE should be assigned to it. NGINX PLUS, a separate and independent corpo
by kuschku 3y ago
And this is the cause of the conflict.
Nginx, the open source project, was safe. No CVE should be assigned to it.
NGINX PLUS, a separate and independent corporate product, was vulnerable. A CVE should be assigned specifically to it.
The issue is that the maintainers of the open source nginx project were paid by the company behind NGINX PLUS, and the company demanded the CVE be assigned to the open source part.
- dns_snek 3y agoNginx, the open source project, wasn't "safe". It was merged, released, came with documentation, and it had public use. I think that's all that matters. How else do you propose that users are informed about vulnerabilities in their installation? That's what CVEs are for.
- kuschku 3y agoWhether you develop new features on main gated by compile flags or on separate branches shouldn't have an effect on CVE assigments. I'm pretty sure that setting arbitrary compile flags is enough to cause vulnerabilities in most software. I personally ran nginx without this feature enabled because it was explicitly marked as experimental and potentially unsafe.