6 posts tagged with "Security"

In APISIX 2.13.0 and previous versions, there is a problem of information leakage caused by the jwt- auth plugin.

In versions prior to Apache APISIX 2.12.1, there is a risk of rewriting X-REAL-IP header after enabling the Apache APISIX batch-requests plug-in. Now the processing information will be announced.

There is a security vulnerability of unauthorized access in Apache APISIX Dashboard 2.7-2.10, and the processing information will be announced.

In versions prior to Apache APISIX 2.10.2, there was a problem of "bypassing partial restrictions" that caused the risk of path penetration by using the $request_uri variable in Apache APISIX Ingress Controller.

Because the application makes access control determinations by obtaining the value of the request header X-Forwarded-For, an attacker can achieve an access control bypass attack by simply tampering with that request header when invoking the API request.

On May 26, NGINX issued a security announcement that fixed a DNS resolver vulnerability (CVE -2021-23017) in the NGINX resolver.