4 ms·
Does Debian 12 have this patched? But I guess I'm not affected if I don't use `rewrite` or `set` anywhere?
by panzi 5mo ago
Does Debian 12 have this patched? But I guess I'm not affected if I don't use `rewrite` or `set` anywhere?
- lpcvoid 5mo ago[dead]
- iririririr 5mo agoI find it very unlikely that anyone using nginx does NOT use `set` at least. Most nginx use cases are to end tls and then pass the request to node/php/go/etc. So, I bet you have at least one set with attacker controller data on a line like 'proxy_set_header X-Host $host;' edit: nvm. aparently named captures are not affect. Unless you have a $1 somewhere, it should be fine.
- babuskov 5mo agoThe default NGINX PHP integration uses this: # regex to split $uri to $fastcgi_script_name and $fastcgi_path fastcgi_split_path_info ^(.+?\.php)(/.*)$; set $path_info $fastcgi_path_info;
- wiredfool 5mo agoUbuntu has patched as of this morning. Debian doesn't look like they've patched trixie yet.
- rslashuser 5mo agoJust as a PSA, I found that "nginx -v" was not detailed about the version sufficient to check, but "apt list nginx" gave the full version number that was checkable, and indeed the 24.04 version of this morning (1.24.0-2ubuntu7.8) is patched.
- aftbit 5mo agohttps://security-tracker.debian.org/tracker/CVE-2026-42945 https://security-tracker.debian.org/tracker/CVE-2026-42945