# Nginx Debian vulnerabilities **URL:** \ **Category:** NGINX\ **Created:** [August 12, 2010, 8:04pm UTC](https://www.ruby-forum.com/t/nginx-debian-vulnerabilities/193192 "2010-08-12T20:04:05Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\ **Post date:** [August 12, 2010, 8:04pm UTC](https://www.ruby-forum.com/t/nginx-debian-vulnerabilities/193192/1 "2010-08-12T20:04:05Z")
Are the vulnerabilities listed at [nginx security advisories](http://nginx.org/en/security_advisories.html) fixed in the recent debian lenny packet? # nginx -v nginx version: nginx/0.6.32 ## I’ve installed nginx through apt-get install nginx, am I vunerable to any of those vulnerabilities? GMX DSL SOMMER-SPECIAL: Surf & Phone Flat 16.000 für nur 19,99 ¿/mtl.!\* > **[News: Aktuelle Nachrichten, Ratgeber, Sport & vieles mehr](https://www.gmx.net/magazine/news/)** > > In den Magazinen finden Sie Nachrichten und Bilder zu Themen wie Unterhaltung, Sport, News und vieles mehr. ---
**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\ **Post date:** [August 12, 2010, 8:41pm UTC](https://www.ruby-forum.com/t/nginx-debian-vulnerabilities/193192/2 "2010-08-12T20:41:33Z")
On Thu, 2010-08-12 at 17:10 +0200, [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Are the vulnerabilities listed at [nginx security advisories](http://nginx.org/en/security_advisories.html) fixed in the recent debian lenny packet? > > # nginx -v > > nginx version: nginx/0.6.32 > > I’ve installed nginx through apt-get install nginx, am I vunerable to any of those vulnerabilities? The vulnerable versions are listed on the page you linked, so you seem to have answered your own question. In any case, 0.6.x is old and unsupported and 0.6.32 isn’t even the latest of the old, unsupported releases. You are certainly vulnerable to any non-Windows-specific issues. You should install at least 0.7.x. Cliff – ---
**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\ **Post date:** [August 12, 2010, 9:10pm UTC](https://www.ruby-forum.com/t/nginx-debian-vulnerabilities/193192/3 "2010-08-12T21:10:49Z")
On 12 Ago 2010 16h10 WEST, [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Are the vulnerabilities listed at > [nginx security advisories](http://nginx.org/en/security_advisories.html) fixed in the recent > debian lenny packet? > > # nginx -v > > nginx version: nginx/0.6.32 > > I’ve installed nginx through apt-get install nginx, am I vunerable > to any of those vulnerabilities? Why don’t you do some Apt pinning and use the version from testing? Currently it’s 0.7.67. — appa ---
**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\ **Post date:** [August 13, 2010, 7:48pm UTC](https://www.ruby-forum.com/t/nginx-debian-vulnerabilities/193192/4 "2010-08-13T19:48:24Z")
Hello! On Thu, Aug 12, 2010 at 05:10:16PM +0200, [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Are the vulnerabilities listed at [nginx security advisories](http://nginx.org/en/security_advisories.html) fixed in the recent debian lenny packet? > > # nginx -v > > nginx version: nginx/0.6.32 > > I’ve installed nginx through apt-get install nginx, am I vunerable to any of those vulnerabilities? According to [http://patch-tracker.debian.org/package/nginx/0.6.32-3+lenny3](http://patch-tracker.debian.org/package/nginx/0.6.32-3+lenny3) it has applied patches for CVE-2009-2629 (VU#180065) and CVE-2009-3896. The following remain: - CVE-2009-3555 - you have to ensure your OpenSSL installation is safe if you are using ssl (most likely it is - the patch was released before fixed OpenSSL was widely available) - CVE-2009-3898 - you shouldn’t expose webdav module to untrusted users They aren’t critical (well, CVE-2009-3555 is, but you are likely have it patched in OpenSSL itself) but it’s probably good idea to upgrade anyway if you are planning to use nginx for something serious. 0.6.32 is just way too old. Maxim D. ---
**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\ **Post date:** [August 13, 2010, 11:56pm UTC](https://www.ruby-forum.com/t/nginx-debian-vulnerabilities/193192/5 "2010-08-13T23:56:04Z")
On 13 Ago 2010 22h28 WEST, [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Hi, > > IIRC from asking once, they don’t apply patches, they just bundle. > However, even on Sid nginx is way behind, so i prefer to build from > source, install with checkinstall (so i can purge if necessary and > to keep things overall clean), and pin it. Not quite. Here’s how the current version on Sid/Squeeze, 0.7.67 is structured when unpacking the src .deb pkg. in the nginx-0.7.67/debian/patches directory: -rwxr-xr-x 1 appa appa 921 Ago 9 10:24 dlopen.diff -rw-r–r-- 1 appa appa 587 Ago 9 10:24 fix\_reloading\_ipv6.diff -rw-r–r-- 1 appa appa 44205 Ago 9 10:24 nginx-upstream-fair.diff -rw-r–r-- 1 appa appa 93 Ago 9 10:24 series According to [nginx: download](http://nginx.org/en/download.html), 0.7.67 is the _stable_ version. So yes debian is behind the _development_ version but is synched with the stable version. checkinstall is just an incredible brittle tool for packaging software. Debian packaging is somewhat complex. There are reasons for that. Maintaining system consistency being one of them. You’re better off just compiling the original source and installing it under /usr/local/sbin. Be sure to have the proper PATH settings and all should work. Use epkg ([http://www.encap.org/epkg](http://www.encap.org/epkg)) to have the all thing fit in one central location with automagical symlinks to the proper locations. You can even have both the Debian package and your custom compiled from source version. Of the right way ™ is to roll your own .deb package with the proper policy. — appa ---
**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\ **Post date:** [August 14, 2010, 4:28am UTC](https://www.ruby-forum.com/t/nginx-debian-vulnerabilities/193192/6 "2010-08-14T04:28:48Z")
On Fri, Aug 13, 2010 at 22:52, António P. P. Almeida [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > So yes debian is behind the _development_ version but is > synched with the stable version. Shouldn’t Debian unstable be in sync with the development branch, and Debian stable with nginx stable? ---
**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\ **Post date:** [August 13, 2010, 11:30pm UTC](https://www.ruby-forum.com/t/nginx-debian-vulnerabilities/193192/7 "2010-08-13T23:30:19Z")
Hi, IIRC from asking once, they don’t apply patches, they just bundle. However, even on Sid nginx is way behind, so i prefer to build from source, install with checkinstall (so i can purge if necessary and to keep things overall clean), and pin it. My 2¢, HTH, Nuno