The following security flaw in nginx was reported [1]: "" A bug in the experimental SPDY implementation in nginx was found, which might allow an attacker to cause a heap memory buffer overflow in a worker process by using a specially crafted request, potentially resulting in arbitrary code execution (CVE-2014-0133). The problem affects nginx 1.3.15 - 1.5.11, compiled with the ngx_http_spdy_module module (which is not compiled by default) and without --with-debug configure option, if the "spdy" option of the "listen" directive is used in a configuration file. The problem is fixed in nginx 1.5.12, 1.4.7. "" The version of nginx in EPEL 5 and 6 is too old to be affected. The Fedora builds do use the "--with-debug" option so should not be affected. Upstream fix: http://nginx.org/download/patch.2014.spdy2.txt [1] http://mailman.nginx.org/pipermail/nginx-announce/2014/000135.html
This issue does not affect the version of nginx as shipped with Fedora 19 and Fedora 20. This issue does not affect the version of nginx as shipped with EPEL 5 and EPEL 6.