You are correct. They never fixed issues #2, #3, and #6 (as stated under "Vendor... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		mrb on May 11, 2017 \| parent \| context \| favorite \| on: Nginx DNS resolver vulnerabilities allow cache poi... You are correct. They never fixed issues #2, #3, and #6 (as stated under "Vendor response".) Any half decent resolver properly randomizes both ports and txid not using the predictable libc random(), but nginx developers have staunchly refused to do so...

agwa on May 11, 2017 [–]

Thanks for posting this publicly!

I suggest updating your post to say that the issues are still unfixed as of today's date.

mrb on May 11, 2017 | [–]

Done.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact