Opened 10 years ago

Closed 10 years ago

#620 closed defect (fixed)

NGINX binary for windows needs to be relinked with OpenSSL 1.0.1i

Reported by: Tim Mackenzie Owned by:
Priority: major Milestone:
Component: nginx-core Version: 1.6.x
Keywords: vulnerability Cc:
uname -a: C:\Users\timm\Downloads\nginx-1.6.1\nginx-1.6.1>uname -a
'uname' is not recognized as an internal or external command,
operable program or batch file.
nginx -V:
C:\Users\timm\Downloads\nginx-1.6.1\nginx-1.6.1>nginx.exe -V
nginx version: nginx/1.6.1
TLS SNI support enabled
configure arguments: --with-cc=cl --builddir=objs.msvc8 --with-debug --prefix= -
-conf-path=conf/nginx.conf --pid-path=logs/ --http-log-path=logs/access
.log --error-log-path=logs/error.log --sbin-path=nginx.exe --http-client-body-te
mp-path=temp/client_body_temp --http-proxy-temp-path=temp/proxy_temp --http-fast
cgi-temp-path=temp/fastcgi_temp --http-scgi-temp-path=temp/scgi_temp --http-uwsg
i-temp-path=temp/uwsgi_temp --with-cc-opt=-DFD_SETSIZE=1024 --with-pcre=objs.msv
c8/lib/pcre-8.35 --with-zlib=objs.msvc8/lib/zlib-1.2.8 --with-select_module --wi
th-http_realip_module --with-http_addition_module --with-http_sub_module --with-
http_dav_module --with-http_stub_status_module --with-http_flv_module --with-htt
p_mp4_module --with-http_gunzip_module --with-http_gzip_static_module --with-htt
p_auth_request_module --with-http_random_index_module --with-http_secure_link_mo
dule --with-mail --with-openssl=objs.msvc8/lib/openssl-1.0.1h --with-openssl-opt
=enable-tlsext --with-http_ssl_module --with-mail_ssl_module --with-ipv6


Hi Nginx support,

OpenSSL released a new release of its 1.0.1 version on August 6, 2014 to correct a number of security vulnerabilities (see The last time this happened, the nginx 1.6.0 windows binaries were relinked to use the newly released openssl (see blog Will this be done again for the August 6, 2014 vulnerabilty fixes? Or is there a reason that this has not been done?

Thanks for your help,


Change History (1)

comment:1 by Maxim Dounin, 10 years ago

Resolution: fixed
Status: newclosed

The nginx 1.7.5 and nginx 1.6.2 was released, win32 binaries are compiled against latest OpenSSL.

Note: See TracTickets for help on using tickets.