Inclusion of Nginx 1.21 or later in openresty builds

[mamatha b]

Hello Team

 

Are there any timelines as to when openresty update with nginx core of 1.21 or later will be made available. 

Looking for the fix for vulnerability CVE-2021-3618 which is fixed with nginx core 1.21 or later. 

 

Thank you.

 

 

Regards

Mamatha Busi

 

[weiping he]

should be soon, as per the discussion slack & irc channel, ISTM will happen by the end of September, 2021

mamatha b <mamatha...@gmail.com> 于2021年9月17日周五 上午11:12写道：

--
You received this message because you are subscribed to the Google Groups "openresty-en" group.
To unsubscribe from this group and stop receiving emails from it, send an email to openresty-en...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/openresty-en/b2d2e4b7-b9df-4575-8568-66c638b558fcn%40googlegroups.com.

[mamatha b]

Great!

Thank you..

[李俊龙]

If you use the openresty official prebuilt package, then you do not need to worry about the   CVE-2021-3618.

Because the issue only affects the mail module which was not compiled into the openresty release binary package.

If you compile the openresty from the source and use the mail module, then you can backport the patch yourself.

https://github.com/nginx/nginx/commit/173f16f736c10eae46cd15dd861b04b82d91a37a

openresty will start to update with nginx core of 1.21 in the next month.

[mamatha b]

Thank you for the response. This helps.