NGINX Addresses Critical Vulnerabilities Including RCE and TLS Client-Cert Bypass

NGINX released versions 1.30.6 and 1.31.7 to address five critical vulnerabilities, including one dating back to 2005 that could enable remote code execution. The updates fix memory issues, TLS session forgery risks, and potential bypasses of client-certificate checks.

NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005.

There are three memory bugs that F5, the company behind NGINX, says could crash a worker process or possibly let an attacker run code, and each requires a specific configuration to exploit.

A fourth lets an attacker forge a TLS session that could

Read original article