{"id":116173,"date":"2024-05-30T00:20:28","date_gmt":"2024-05-29T22:20:28","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/novaya-versiya-nginx-1-27-0-c-ustraneniem-4-uyazvimostej-v-realizaczii-http-3"},"modified":"2024-05-30T00:20:28","modified_gmt":"2024-05-29T22:20:28","slug":"novaya-versiya-nginx-1-27-0-c-ustraneniem-4-uyazvimostej-v-realizaczii-http-3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/novaya-versiya-nginx-1-27-0-c-ustraneniem-4-uyazvimostej-v-realizaczii-http-3","title":{"rendered":"Nov\u00e1 verze nginx 1.27.0 s odstran\u011bn\u00edm 4 zranitelnost\u00ed v implementaci HTTP\/3","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Bylo vyd\u00e1no prvn\u00ed vyd\u00e1n\u00ed nov\u00e9 hlavn\u00ed v\u011btve nginx 1.27.0, v r\u00e1mci kter\u00e9 bude pokra\u010dovat v\u00fdvoj nov\u00fdch funkc\u00ed. Sou\u010dasn\u011b byla vytvo\u0159ena verze nginx 1.26.1, pat\u0159\u00edc\u00ed ke stabiln\u00ed v\u011btvi, kter\u00e1 je paraleln\u011b podporov\u00e1na a do kter\u00e9 se zav\u00e1d\u011bj\u00ed pouze zm\u011bny souvisej\u00edc\u00ed s odstran\u011bn\u00edm v\u00e1\u017en\u00fdch chyb a zranitelnost\u00ed. V n\u00e1sleduj\u00edc\u00edm roce bude na z\u00e1klad\u011b hlavn\u00ed v\u011btve 1.27.x vytvo\u0159ena stabiln\u00ed v\u011btev 1.28. K\u00f3d projektu je naps\u00e1n v jazyce C a je distribuov\u00e1n pod licenc\u00ed BSD. <\/p>\n

V nov\u00fdch verz\u00edch bylo opraveno 4 zranitelnosti, kter\u00e9 se t\u00fdkaj\u00ed experiment\u00e1ln\u00edho modulu ngx_http_v3 (ve v\u00fdchoz\u00edm nastaven\u00ed vypnut\u00e9ho), kter\u00fd poskytuje podporu protokolu HTTP\/3, vyu\u017e\u00edvaj\u00edc\u00edho protokol QUIC jako transport pro HTTP\/2. Probl\u00e9my se projevuj\u00ed pouze p\u0159i aktivaci modulu ngx_http_v3_module a nastaven\u00ed mo\u017enosti «quic» v direktiv\u011b «listen». O zranitelnosti fork\u016f Angie a FreeNginx zat\u00edm nebylo nic ozn\u00e1meno. <\/p>\n

Zranitelnost CVE-2024-34161 vede k \u00faniku obsahu pam\u011bti pracovn\u00edho procesu na syst\u00e9mech s MTU nastaven\u00fdm na v\u00edce ne\u017e 4096 bajt\u016f. \u00danik obsahu pam\u011bti nast\u00e1v\u00e1 p\u0159i odes\u00edl\u00e1n\u00ed r\u00e1mc\u016f CRYPTO, kter\u00e9 se pou\u017e\u00edvaj\u00ed p\u0159i vyjedn\u00e1v\u00e1n\u00ed spojen\u00ed, v dob\u011b po odesl\u00e1n\u00ed fin\u00e1ln\u00ed zpr\u00e1vy klientem. <\/p>\n

Zranitelnosti CVE-2024-31079, CVE-2024-32760 a CVE-2024-35200 jsou zp\u016fsobeny po\u0161kozen\u00edm pam\u011bti a umo\u017e\u0148uj\u00ed vzd\u00e1len\u00e9mu \u00fato\u010dn\u00edkovi zp\u016fsobit hav\u00e1rii pracovn\u00edho procesu nginx prost\u0159ednictv\u00edm nastaven\u00ed speci\u00e1ln\u011b upraven\u00e9 relace zalo\u017een\u00e9 na protokolu QUIC. U zranitelnost\u00ed CVE-2024-31079 a CVE-2024-32760 nejsou vylou\u010deny ani dal\u0161\u00ed n\u00e1sledky \u00fatoku (potenci\u00e1ln\u00ed mo\u017enost vykon\u00e1n\u00ed k\u00f3du \u00fato\u010dn\u00edka?). Podrobnosti nejsou uvedeny, ale podle oprav v k\u00f3du jsou zranitelnosti zp\u016fsobeny p\u0159\u00edstupem k ji\u017e uvoln\u011bn\u00e9 pam\u011bti (use-after-free), nespr\u00e1vn\u00fdm alokov\u00e1n\u00edm pam\u011bti pro pole, dereferencov\u00e1n\u00edm nulov\u00e9ho ukazatele a nedostatkem odpov\u00eddaj\u00edc\u00ed kontroly velikosti dat um\u00edst\u011bn\u00fdch do vyrovn\u00e1vac\u00ed pam\u011bti. <\/p>\n

Mezi zm\u011bnami nesouvisej\u00edc\u00edmi s odstran\u011bn\u00edm zranitelnost\u00ed v nginx 1.27.0: <\/p>\n