From 69026c5db99baf65e65ae73c0075f21aae25aca8 Mon Sep 17 00:00:00 2001 From: alan bount Date: Tue, 20 Sep 2016 16:35:58 -0400 Subject: [PATCH] security fix OpenSSL Oracle vuln. (CVE-2016-2107) Add security fix for OpenSSL Padding Oracle vuln. (CVE-2016-2107) Relates to SSL insecurity reporting here: https://github.com/meteorhacks/mup-frontend-server/issues/14 Fix found at: https://github.com/ckiely91/mup-frontend-server/commit/e151dd6939a0f0587e01dfda0c260ce0409f6883 --- lib/install-nginx.sh | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/lib/install-nginx.sh b/lib/install-nginx.sh index c717bb5..98d8c93 100644 --- a/lib/install-nginx.sh +++ b/lib/install-nginx.sh @@ -1,4 +1,4 @@ -set -e +set -e BUILD_DIR=/tmp/nginx NGINX_VERSION=1.8.0 @@ -11,6 +11,7 @@ useradd $NGINX_USER || : # install dependencies apt-get update apt-get -y install libpcre3-dev libssl-dev openssl build-essential wget +apt-get -y --only-upgrade install libssl1.0.0 openssl # start building process @@ -37,4 +38,4 @@ apt-get -y remove build-essential wget apt-get -y autoremove # generate new Diffie-Hellman group -openssl dhparam -out /dhparams.pem 2048 \ No newline at end of file +openssl dhparam -out /dhparams.pem 2048