The first release of the new main branch nginx 1.21.0 has been announced, which will continue to develop new features. At the same time, a corrective release of the parallel stable branch 1.20.1 has been prepared, which includes only changes related to fixing serious bugs and vulnerabilities. A stable branch 1.22 will be formed next year based on the main branch 1.21.x.
The new versions have resolved a vulnerability (CVE-2021-23017) in the code for resolving hostnames in DNS, which can lead to crashes or potentially allow the execution of attacker code. The issue manifests in the processing of certain responses from the DNS server, leading to a one-byte buffer overflow. The vulnerability only appears when enabled in the DNS resolver settings using the directive 'resolver'. To exploit this, an attacker must be able to spoof UDP packets from the DNS server or gain control of the DNS server. The vulnerability is present starting from the nginx release 0.6.18. A patch can be used to fix the issue in older releases.
Changes in nginx 1.21.0 unrelated to security:
- Support for variables has been added in the directives 'proxy_ssl_certificate', 'proxy_ssl_certificate_key', 'grpc_ssl_certificate', 'grpc_ssl_certificate_key', 'uwsgi_ssl_certificate', and 'uwsgi_ssl_certificate_key'.
- The mail proxy module has been updated to support 'pipelining' for sending multiple POP3 or IMAP requests in a single connection, along with a new directive 'max_errors' that defines the maximum number of protocol errors after which the connection will be closed.
- A parameter 'fastopen' has been added to the stream module, enabling 'TCP Fast Open' mode for listening sockets.
- Issues with escaping special characters during automatic redirects with a trailing slash have been resolved.
- The problem with closing connections to clients when using SMTP pipelining has been fixed.
Source: opennet.ru
