Published: 19 November 2019
nginx http proxy module does not verify peer identity of https origin server which could facilitate man-in-the-middle attack (MITM)
CVSS 3 base score: 4.8
Launchpad, Ubuntu, Debian
|Ubuntu 14.04 ESM (Trusty Tahr)||
Backporting this fix is non-trivial and may break deployed applications. Someone who really wanted this could use stunnel as a work-around until 16.04 LTS is released.