{"id":100280,"date":"2021-05-25T22:22:55","date_gmt":"2021-05-25T20:22:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypuski-nginx-1-21-0-i-nginx-1-20-1-s-ustraneniem-uyazvimosti"},"modified":"2021-05-25T22:22:55","modified_gmt":"2021-05-25T20:22:55","slug":"vypuski-nginx-1-21-0-i-nginx-1-20-1-s-ustraneniem-uyazvimosti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/vypuski-nginx-1-21-0-i-nginx-1-20-1-s-ustraneniem-uyazvimosti","title":{"rendered":"Verze nginx 1.21.0 a nginx 1.20.1 s opravou zranitelnosti","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Byl p\u0159edstaven prvn\u00ed vyd\u00e1n\u00ed nov\u00e9 hlavn\u00ed v\u011btve nginx 1.21.0, v r\u00e1mci kter\u00e9 bude pokra\u010dov\u00e1no ve v\u00fdvoji nov\u00fdch funkc\u00ed. Sou\u010dasn\u011b byl p\u0159ipraven opravn\u00fd vyd\u00e1n\u00ed paraleln\u011b podporovan\u00e9 stabiln\u00ed v\u011btve 1.20.1, ve kter\u00e9 jsou prov\u00e1d\u011bny pouze zm\u011bny souvisej\u00edc\u00ed s odstran\u011bn\u00edm v\u00e1\u017en\u00fdch chyb a zranitelnost\u00ed. V p\u0159\u00ed\u0161t\u00edm roce bude na z\u00e1klad\u011b hlavn\u00ed v\u011btve 1.21.x vytvo\u0159ena stabiln\u00ed v\u011btev 1.22. <\/p>\n
Ve nov\u00fdch verz\u00edch byla odstran\u011bna zranitelnost (CVE-2021-23017) v k\u00f3du pro resolvov\u00e1n\u00ed jmen hostitel\u016f v DNS, kter\u00e1 m\u016f\u017ee v\u00e9st k p\u00e1du nebo potenci\u00e1ln\u011b k proveden\u00ed k\u00f3du \u00fato\u010dn\u00edka. Probl\u00e9m se projevuje p\u0159i zpracov\u00e1n\u00ed ur\u010dit\u00fdch odpov\u011bd\u00ed DNS serveru, co\u017e m\u016f\u017ee v\u00e9st k jednov\u00fdznamov\u00e9mu p\u0159ete\u010den\u00ed bufferu. Zranitelnost se projevuje pouze p\u0159i aktivaci v nastaven\u00ed DNS resolveru pomoc\u00ed direktivy «resolver». K proveden\u00ed \u00fatoku mus\u00ed \u00fato\u010dn\u00edk m\u00edt mo\u017enost podvrhnout UDP pakety od DNS serveru nebo z\u00edskat kontrolu nad DNS serverem. Zranitelnost se projevuje od verze nginx 0.6.18. K odstran\u011bn\u00ed probl\u00e9mu ve star\u00fdch verz\u00edch lze pou\u017e\u00edt patch. <\/p>\n
Zm\u011bny v nginx 1.21.0, kter\u00e9 nejsou bezpe\u010dnostn\u00ed: <\/p>\n
\n
Do direktiv \u201eproxy_ssl_certificate\u201c, \u201eproxy_ssl_certificate_key\u201c, \u201egrpc_ssl_certificate\u201c, \u201egrpc_ssl_certificate_key\u201c, \u201euwsgi_ssl_certificate\u201c a \u201euwsgi_ssl_certificate_key\u201c byla p\u0159id\u00e1na podpora prom\u011bnn\u00fdch.\n
Do po\u0161tov\u00e9ho proxy modulu byla p\u0159id\u00e1na podpora «pipelining» pro p\u0159enos n\u011bkolika po\u017eadavk\u016f POP3 nebo IMAP v jednom spojen\u00ed, a tak\u00e9 byla p\u0159id\u00e1na nov\u00e1 direktiva «max_errors», kter\u00e1 ur\u010duje maxim\u00e1ln\u00ed po\u010det chyb protokolu, po kter\u00fdch bude spojen\u00ed uzav\u0159eno.\n
Do modulu stream byl p\u0159id\u00e1n parametr \u201efastopen\u201c, kter\u00fd aktivuje re\u017eim \u201eTCP Fast Open\u201c pro naslouchaj\u00edc\u00ed sokety.\n
Byly vy\u0159e\u0161eny probl\u00e9my s escapov\u00e1n\u00edm speci\u00e1ln\u00edch znak\u016f p\u0159i automatick\u00e9m p\u0159esm\u011brov\u00e1n\u00ed s p\u0159id\u00e1n\u00edm lom\u00edtka na konec.\n
Byl vy\u0159e\u0161en probl\u00e9m s uzav\u00edr\u00e1n\u00edm spojen\u00ed se z\u00e1kazn\u00edky p\u0159i pou\u017eit\u00ed SMTP pipelining. <\/ul>\n