# Nginx and CVE-2010-3864

**URL:** <https://www.ruby-forum.com/t/nginx-and-cve-2010-3864/199280>\
**Category:** NGINX\
**Created:** [November 17, 2010, 8:33pm UTC](https://www.ruby-forum.com/t/nginx-and-cve-2010-3864/199280 "2010-11-17T20:33:35Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dobai-Pataky\_BSSSSl](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/77aa72/32.png) [@Dobai-Pataky\_BSSSSl](https://www.ruby-forum.com/u/Dobai-Pataky_BSSSSl)\
**Post date:** [November 17, 2010, 8:33pm UTC](https://www.ruby-forum.com/t/nginx-and-cve-2010-3864/199280/1 "2010-11-17T20:33:35Z")

</div>

I think I know the answer to this but since the consequences of  
misguessing are somewhat dire, I figured I’d better ask.

For the advisory,

[http://www.openssl.org/news/secadv\_20101116.txt](http://www.openssl.org/news/secadv_20101116.txt)

are we nginx users safe if we’re using one of the affected versions  
(and rechecking [security.debian.org](http://security.debian.org) every 10 minutes) but only ever  
use:

ssl\_session\_cache shared:sslache:…

i.e. _not_: ssl\_session\_cache builtin:…

?

> From the wording of the advisory, it _sounds_ like ‘shared’ bypasses  
> the affected internal caching, but I wanted to be extra cautious.  
> Clearly the right fix is to get openssl upgraded but until Debian gets  
> their update out, it’d be good to know that nginx is not affected (at  
> least with ssl\_session\_cache shared:…). Thanks!

---

<div class="post-metadata">

**Author:** ![mark](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e9c0ed/32.png) [@mark](https://www.ruby-forum.com/u/mark)\
**Post date:** [November 18, 2010, 1:13am UTC](https://www.ruby-forum.com/t/nginx-and-cve-2010-3864/199280/2 "2010-11-18T01:13:48Z")

</div>

Hello!

On Wed, Nov 17, 2010 at 11:31:53AM -0800, Mark M. wrote:

> least with ssl\_session\_cache shared:…). Thanks!  
> nginx should be fine even if openssl’s builtin session cache is  
> used.

Both vulnerability information and code suggests that issue only  
affects multi-threaded programs (due to multiple threads changing  
the same session at the same time). nginx isn’t multi-threaded  
and the race in question isn’t possible.

Maxim D.

---

<div class="post-metadata">

**Author:** ![mark](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/e9c0ed/32.png) [@mark](https://www.ruby-forum.com/u/mark)\
**Post date:** [November 18, 2010, 1:53am UTC](https://www.ruby-forum.com/t/nginx-and-cve-2010-3864/199280/3 "2010-11-18T01:53:35Z")

</div>

On Wed, Nov 17, 2010 at 4:12 PM, Maxim D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> > > From the wording of the advisory, it _sounds_ like ‘shared’ bypasses  
> > > the same session at the same time). nginx isn’t multi-threaded  
> > > and the race in question isn’t possible.
> 
> Maxim D.
> 
> * * *
> 
> nginx mailing list  
> [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
> [mailman.nginx.org archive](http://nginx.org/mailman/listinfo/nginx)

Excellent, thanks for the info. I’d forgotten nginx was event-based,  
not threaded. That is a relief 🙂