# Vulnerability related Doubts in Nginx

**URL:** <https://www.ruby-forum.com/t/vulnerability-related-doubts-in-nginx/244326>\
**Category:** NGINX\
**Created:** [March 22, 2016, 1:05pm UTC](https://www.ruby-forum.com/t/vulnerability-related-doubts-in-nginx/244326 "2016-03-22T13:05:52Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sadaf\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/858c86/32.png) [@Sadaf\_N](https://www.ruby-forum.com/u/Sadaf_N)\
**Post date:** [March 22, 2016, 1:05pm UTC](https://www.ruby-forum.com/t/vulnerability-related-doubts-in-nginx/244326/1 "2016-03-22T13:05:52Z")

</div>

Hi

We are running Nginx version 1.8 ( nginx-1.8.1-1.amzn1.ngx.x86\_64 ) in  
our  
servers. So in the Vulnerability Assessment, Nessus gave report that it  
is  
vulnerable.

_Current version :-_ nginx-1.8.1-1.amzn1.ngx.x86\_64

_Fix Version ( According to Nessus ) :-_ nginx-1.8.1-1.26.amzn1

I don’t seem to find the " Fix Version " of Nginx which Nessus  
suggested.

Is there any work around for this ?

Is 1.8 the latest stable version which is available or we can move  
forward  
with higher one ?

Any help will be appreciated!

---

<div class="post-metadata">

**Author:** ![Zeal\_Vora](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/e79b87/32.png) [@Zeal\_Vora](https://www.ruby-forum.com/u/Zeal_Vora)\
**Post date:** [March 22, 2016, 1:12pm UTC](https://www.ruby-forum.com/t/vulnerability-related-doubts-in-nginx/244326/2 "2016-03-22T13:12:53Z")

</div>

Hi Zeal,

On 3/22/16 3:05 PM, Zeal Vora wrote:

> I don’t seem to find the " Fix Version " of Nginx which Nessus  
> suggested.
> 
> Is there any work around for this ?
> 
> Is 1.8 the latest stable version which is available or we can move  
> forward with higher one ?
> 
> Any help will be appreciated!

Does it help?

> **[ALAS-2016-655](https://alas.aws.amazon.com/ALAS-2016-655.html)**

–  
Maxim K.

---

<div class="post-metadata">

**Author:** ![Zeal\_Vora](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/e79b87/32.png) [@Zeal\_Vora](https://www.ruby-forum.com/u/Zeal_Vora)\
**Post date:** [March 22, 2016, 1:14pm UTC](https://www.ruby-forum.com/t/vulnerability-related-doubts-in-nginx/244326/3 "2016-03-22T13:14:04Z")

</div>

On Tuesday 22 March 2016 17:35:19 Zeal Vora wrote:

> I don’t seem to find the " Fix Version " of Nginx which Nessus suggested.
> 
> Is there any work around for this ?
> 
> Is 1.8 the latest stable version which is available or we can move forward  
> with higher one ?
> 
> Any help will be appreciated!

The CVE-2016-0742 that is referenced in the report is fixed in nginx  
1.8.1.

See here for the official information:

> **[nginx security advisory (CVE-2016-0742, CVE-2016-0746, CVE-2016-0747)](http://mailman.nginx.org/pipermail/nginx/2016-January/049700.html)**

> **[nginx security advisories](http://nginx.org/en/security_advisories.html)**

[http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0742](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0742)

wbr, Valentin V. Bartenev

---

<div class="post-metadata">

**Author:** ![Zeal\_Vora](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/e79b87/32.png) [@Zeal\_Vora](https://www.ruby-forum.com/u/Zeal_Vora)\
**Post date:** [March 22, 2016, 1:17pm UTC](https://www.ruby-forum.com/t/vulnerability-related-doubts-in-nginx/244326/4 "2016-03-22T13:17:34Z")

</div>

@Maxim :-

Thanks. Actually we compile Nginx so to include additional modules. The  
solution mentioned in Amazon page is " yum update nginx " is something  
which will not help as we will need the tar.gz / SRPM file for that  
version.

@Valentin :-

Thanks, actually we already have 1.8.1 but the reported fix is  
in nginx-1.8.1-1.26 for which I can’t find any SRPM / tar.gz file.

On Tue, Mar 22, 2016 at 5:43 PM, Valentin V. Bartenev [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![Zeal\_Vora](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/e79b87/32.png) [@Zeal\_Vora](https://www.ruby-forum.com/u/Zeal_Vora)\
**Post date:** [March 22, 2016, 1:22pm UTC](https://www.ruby-forum.com/t/vulnerability-related-doubts-in-nginx/244326/5 "2016-03-22T13:22:14Z")

</div>

On 3/22/16 3:17 PM, Zeal Vora wrote:

> in nginx-1.8.1-1.26 for which I can’t find any SRPM / tar.gz file.

The nessus report is about the package version. “nginx-1.8.1-1.26”  
is something AWS specific, it doesn’t come from [nginx.org](http://nginx.org).

If you built your own package or compiled nginx from the [nginx.org](http://nginx.org)  
sources you are safe with 1.8.1.

–  
Maxim K.