NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks

NGINX has released updated versions to address five vulnerabilities. The issues include three memory bugs that could cause a worker process to crash or potentially allow an attacker to execute code, although specific configurations are required to exploit these bugs. One of the vulnerabilities has been present in every NGINX release since May 2005. A fourth vulnerability allows an attacker to forge a TLS session. The updates, versions 1.30.6 and 1.31.7, were released on October 14. The vulnerabilities include a possible remote code execution flaw and a TLS bug.