Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

>Was the code in question included in stable releases? If not, I might agree that assigning CVEs are not helpful.

F5 employee says code the was marked as "experimental" but the issue is that customers were running it in production:

https://news.ycombinator.com/item?id=39378523

https://news.ycombinator.com/item?id=39379984

It's worth going through that entire thread and Ctrl+F search userid "MZMegaZone" to get F5's rationale for assigning a CVE.

Why are some customers running experimental code in production?!? I can only assume they do it to solve a problem and take early advantage of a new feature that doesn't exist in the stable release.



Apparently F5 shipped it in production in their proprietary version, while it was not compiled into the free version.

So technically the CVE should be filed against NGINX Plus, not nginx ;)




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: