{"id":166097,"date":"2026-03-25T11:12:50","date_gmt":"2026-03-25T09:12:50","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovleniya-nginx-1-29-7-i-1-28-3-s-ustraneniem-6-uyazvimostej"},"modified":"2026-03-25T11:12:50","modified_gmt":"2026-03-25T09:12:50","slug":"obnovleniya-nginx-1-29-7-i-1-28-3-s-ustraneniem-6-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/obnovleniya-nginx-1-29-7-i-1-28-3-s-ustraneniem-6-uyazvimostej","title":{"rendered":"Opdateringer af nginx 1.29.7 og 1.28.3 med l\u00f8sning af 6 s\u00e5rbarheder","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Udgivelsen af den prim\u00e6re gren nginx 1.29.7 er blevet dannet, hvor der fortsat arbejdes p\u00e5 nye funktioner, samt udgivelsen af den parallelt underst\u00f8ttede stabile gren nginx 1.28.3, som kun modtager \u00e6ndringer relateret til at rette alvorlige fejl og s\u00e5rbarheder. I opdateringerne er der blevet rettet 6 s\u00e5rbarheder, hvoraf tre kan for\u00e5rsage buffer overflow. Fire s\u00e5rbarheder er blevet tildelt et h\u00f8jt fareniveau (8.8 eller 8.5 ud af 10). <\/p>\n
\n
CVE-2026-27654 \u2014 buffer overflow in the ngx_http_dav_module when processing WebDAV requests COPY and MOVE in 'location' blocks with the 'alias' directive. The vulnerability allows altering file paths to access outside the base directory. The issue was identified using the AI model Claude.\n
CVE-2026-27784, CVE-2026-32647 \u2014 buffer overflows in the ngx_http_mp4_module occurring when processing specially crafted mp4 files. Exploitation of the vulnerability is not limited to crashing the worker process.\n
CVE-2026-27651 \u2014 null pointer dereference when incorrectly using CRAM-MD5 or APOP authentication methods.\n
CVE-2026-28753 \u2014 the potential to manipulate PTR records in DNS to inject attacker's data into auth_http requests and the XCLIENT command in SMTP connections to the backend.\n
CVE-2026-28755 \u2014 bypass of the OCSP certificate check result in the stream module. <\/ul>\n
Blandt de ikke-sikkerhedsrelaterede \u00e6ndringer i nginx 1.29.7 <\/p>\n
\n
Der er tilf\u00f8jet st\u00f8tte til Multipath TCP (MPTCP-protokollen), som muligg\u00f8r levering af pakker simultant via flere ruter gennem forskellige netv\u00e6rksgr\u00e6nseflader. For at aktivere det er parameteren 'multipath' tilf\u00f8jet til direktivet 'listen'.\n
A 'local' parameter has been added to the 'keepalive' directive used in the 'upstream' block. When this parameter is specified, a separate connection to the upstream server is maintained for each 'location' and 'server' block instead of sharing a single connection.\n
In the 'upstream' block, the 'keepalive' directive is enabled by default.\n
When used in proxy mode, the HTTP\/1.1 protocol version is set by default with keep-alive mode enabled (the ngx_http_proxy_module has keep-alive support enabled by default, setting '1.1' in the 'proxy_http_version' directive, and the 'Connection' header is no longer sent by default). To return to the old behavior allowing connections to backends that only support HTTP\/1.0, the settings should be: proxy_http_version 1.0; proxy_set_header Connection 'Close'; <\/ul>\n