Bug 8656 - nginx - MITM flaw (CVE-2011-4968)
Summary: nginx - MITM flaw (CVE-2011-4968)
Status: RESOLVED WONTFIX
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: Cauldron
Hardware: i586 Linux
Priority: Normal normal
Target Milestone: ---
Assignee: Sam Bailey
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-01-11 06:47 CET by Oden Eriksson
Modified: 2013-11-22 15:57 CET (History)
3 users (show)

See Also:
Source RPM: nginx
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Oden Eriksson 2013-01-11 06:47:54 CET 
On 01/03/2013 08:36 AM, Daniel Kahn Gillmor wrote:
> nginx offers the ability for its http proxy module to talk to an
> origin server over https.  However, it does not verify the identity
> of the origin server in this case, which leaves it subject to MITM
> attacks between the proxy and the origin server.
>
> Sadly, this appears to be unfixed for over a year after it was
> first reported:
>
> http://trac.nginx.org/nginx/ticket/13
>
> some patch review starts over here, but doesn't seem to reach any
> resolution:
>
> http://mailman.nginx.org/pipermail/nginx-devel/2011-September/001182.html
>
>  As far as i can tell, there is no CVE assigned for this yet.
>
> --dkg
>

Yup. Please use CVE-2011-4968 for this issue.
Manuel Hiebel 2013-01-11 22:32:15 CET

Assignee: bugsquad => shikamaru
Source RPM: (none) => nginx

Comment 1 David Walser 2013-01-31 22:52:41 CET 
Here's RedHat's bug for this:
https://bugzilla.redhat.com/show_bug.cgi?id=892030

CC: (none) => luigiwalser

David Walser 2013-01-31 22:54:32 CET

CC: (none) => fundawang

David Walser 2013-02-01 19:43:09 CET

Summary: CVE-2011-4968: nginx - MITM flaw => nginx - MITM flaw (CVE-2011-4968)

Comment 2 David Walser 2013-11-22 15:57:33 CET 
Closing this as WONTFIX as RedHat has done the same.

Status: NEW => RESOLVED
CC: (none) => shikamaru
Version: 2 => Cauldron
Resolution: (none) => WONTFIX
Assignee: shikamaru => sam
Note You need to log in before you can comment on or make changes to this bug.