The first release of the new main branch nginx 1.27.0 has been introduced, in which the development of new features will continue. At the same time, nginx 1.26.1 has been formed, which belongs to the concurrently supported stable branch, where only changes related to fixing serious bugs and vulnerabilities are made. Next year, a stable branch 1.28 will be created based on the main branch 1.27.x. The project code is written in C language and is distributed under the BSD license.
The new releases fix 4 vulnerabilities affecting the experimental module ngx_http_v3 (disabled by default), which provides support for the HTTP/3 protocol that uses the QUIC protocol as transport for HTTP/2. The issues only manifest when the ngx_http_v3_module is activated and the 'quic' option is set in the 'listen' directive. There is currently no information regarding the vulnerability exposure of the forks Angie and FreeNginx.
The vulnerability CVE-2024-34161 leads to memory content leakage of the worker process on systems with an MTU set to more than 4096 bytes. The memory content leak occurs when sending CRYPTO frames used during the connection handshake, after the client has sent the finalizing message.
The vulnerabilities CVE-2024-31079, CVE-2024-32760, and CVE-2024-35200 are caused by memory corruption and allow a remote attacker to crash the nginx worker process by establishing a specially crafted session based on the QUIC protocol. For vulnerabilities CVE-2024-31079 and CVE-2024-32760, other attack consequences (potential remote code execution?) cannot be ruled out. Details are not given, but judging by the code fixes, the vulnerabilities are caused by accessing already freed memory (use-after-free), improper memory allocation for an array, dereferencing a null pointer, and insufficient checking of the size of the data placed in the buffer.
Among the changes in nginx 1.27.0 that are unrelated to vulnerability fixes:
- Support for specifying variables has been added to the directives 'proxy_limit_rate', 'fastcgi_limit_rate', 'scgi_limit_rate', and 'uwsgi_limit_rate'.
- Memory consumption has been reduced when handling long-lived requests in configurations that use the directives 'gzip', 'gunzip', 'ssi', 'sub_filter', or 'grpc_pass'.
- Issues with downgrading in GCC 14 when using the option '--with-atomic' have been resolved.
- Errors in the implementation of HTTP/3 have been fixed.
Additionally, it's worth noting the release of a new main branch FreeNginx 1.27.0, a fork of Nginx developed by Maxim Dunin, one of the key Nginx developers. FreeNginx is positioned as a non-commercial project that ensures the development of the Nginx codebase without corporate interference. The new version improves error handling while reading request bodies, fixes compilation in NetBSD 10.0, and enhances PID file writing (an 'off' parameter has been added to the 'pid' directive).
Source: opennet.ru
