Nginx PageSpeed ngx_pagespeed security update release 1.8.31.4-beta

rdan · Jun 19, 2014

ngx_pagespeed version 1.8.31.4-beta fixes a major security vulnerability in HTTPS fetching. All versions of ngx_pagespeed since 1.8.31.2-beta are affected. The vulnerability only affects users that have enabled the FetchHttps feature; users that have not explicitly enabled FetchHttps are not affected.

All users running a vulnerable version of PageSpeed with FetchHttps enabled should update their pagespeed packages.

A vulnerability was found in the version of OpenSSL used by PageSpeed. CVE-2014-0224 ( http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0224 ) which allowed a malicious user to perform a man-in-the middle attack on encrypted traffic.

The previous release of ngx_pagespeed (1.8.31-3-beta) used OpenSSL 1.0.1 and is impacted by CVE-2014-0224. Latest version 1.8.31.4-beta uses a version of OpenSSL in which the vulnerability has been fixed.

Upgrade instructions:

Follow the installation instructions here: https://github.com/pagespeed/ngx_pagespeed#readme

eva2000 · Jun 19, 2014

Wow nice fine @RoldanLT

Updated .07 beta 21 Github and 290514 dated zip with new version of ngx_pagespeed 1.8.31-4 beta https://community.centminmod.com/threads/update-ngx_pagespeed-1-8-31-4-beta.511/

1.8.31.4 release notes https://developers.google.com/speed/pagespeed/module/release_notes

mod_pagespeed and ngx_pagespeed Security Advisory: SSL fetching man-in-the-middle attack.
Disclosed:
June 17th, 2014

Versions Affected:

mod_pagespeed 1.7.30.1 through 1.7.30.4 (fixed in 1.7.30.5)

mod_pagespeed and ngx_pagespeed 1.8.31.1 through 1.8.31.3 (fixed in 1.8.31.4)

Summary:
Some versions of mod_pagespeed and ngx_pagespeed, in order to support fetching of HTTPS content, link in versions of OpenSSL that are vulnerable to a man-in-the-middle attack. This attack permits an adversary that can monitor and alter traffic between a client (mod_pagespeed or ngx_pagespeed in this case) and a server to decrypt and modify encrypted transfers, as long as both are running vulnerable versions (see CVE-2014-0224 for more detail).

mod_pagespeed and ngx_pagespeed users are only vulnerable if they turn on the optional FetchHttps feature.

Solution:
For mod_pagespeed, update to one of versions 1.7.30.5-stable, 1.8.31.4-beta or newer.

For ngx_pagespeed, update to 1.8.31.4-beta or newer.

Workaround:
Use a method other than FetchHttps to fetch https content, as described in HTTP Support documentation.
Click to expand...

Log in / Register

Forums

Discover Centmin Mod today

Nginx PageSpeed ngx_pagespeed security update release 1.8.31.4-beta

rdan Well-Known Member

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Discover Centmin Mod today

Nginx PageSpeed ngx_pagespeed security update release 1.8.31.4-beta

rdan Well-Known Member

eva2000 Administrator Staff Member

.