Affected by nginx vulnerability?

[ostermmg]

We've come across this vulnerability notice:

US-CERT Vulnerability Note VU#180065 (a.k.a. CVE-2009-2629)

It's our understanding that ZCS uses nginx for its proxy.

Does this vulnerability affect ZCS 5.0.x?

[Matt]

I would like the answer to this too. I have a feeling the answer is yes because the version reported is 0.5.30 on zcs-NETWORK-5.0.16_GA. Zimbra 6.0.0 seems affected too... nginx 0.5.37. Not sure about 6.0.1 but no mention in the release notes so I would guess yes.

[Matt]

5.0.19 has a fixed version of nginx. 6.0.2 (unreleased) will fix this too.