<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><br class=""></div>Hmm. OK. Well, I had at least one site saying that their network admins would have to block the Testbed node if<div class="">nginx was not upgraded. Here is what they sent me.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><img border="0" id="Afbeelding_x0020_2" style="font-family: Calibri, sans-serif; font-size: 14.666666984558105px;" apple-inline="yes" src="cid:image002.png@01D55BF0.4630F570" class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Sep 11, 2019, at 2:42 PM, Junxiao Shi <<a href="mailto:shijunxiao@email.arizona.edu" class="">shijunxiao@email.arizona.edu</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html; charset=utf-8" class=""><div dir="ltr" class=""><div class="">Hi John</div><div class=""><br class=""></div><div class="">There's no "security hole" in Ubuntu 16.04's nginx, as long as you regularly update all system packages via `sudo apt full-upgrade`.</div><div class="">Canonical Inc backports security patches for recent vulnerabilities. You can see them here:<br class=""></div><div class=""><a href="http://changelogs.ubuntu.com/changelogs/pool/main/n/nginx/nginx_1.10.3-0ubuntu0.16.04.4/changelog" class="">http://changelogs.ubuntu.com/changelogs/pool/main/n/nginx/nginx_1.10.3-0ubuntu0.16.04.4/changelog</a> <br class=""></div><div class=""><br class=""></div><div class="">To minimize problems, do not upgrade between Ubuntu package source and nginx package server <a href="https://nginx.org/en/linux_packages.html#Ubuntu" class="">https://nginx.org/en/linux_packages.html#Ubuntu</a></div><div class="">Instead, delete the old packages with `sudo apt purge nginx`, and then install new packages normally.</div><div class=""><br class=""></div><div class="">Yours, Junxiao</div><br class=""><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Sep 10, 2019 at 11:53 AM Dehart, John <<a href="mailto:jdd@wustl.edu" class="">jdd@wustl.edu</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br class="">
All:<br class="">
<br class="">
I recently had some requests to upgrade the version of nginx because of some security holes in the<br class="">
version we had been running. I updated the configuration to use nginx version 1.17.3.<br class="">
But, now I have a problem with that version. On several nodes, the configuration directory for nginx, /etc/nginx,<br class="">
disappears. I’m trying to track down what might be happening, but if anyone has seen this kind of<br class="">
thing before let me know.<br class="">
<br class="">
Thanks,<br class="">
John<br class=""><br class="">
</blockquote></div></div>
</div></blockquote></div><br class=""></div></body></html>