The release of the main branch nginx 1.23.2 has been formed, which continues the development of new features, alongside the release of the concurrently supported stable branch nginx 1.22.1, which only includes changes related to the elimination of serious bugs and vulnerabilities.
In the new versions, two vulnerabilities (CVE-2022-41741, CVE-2022-41742) in the ngx_http_mp4_module, used for streaming from H.264/AAC files, have been fixed. These vulnerabilities may lead to memory corruption or memory leak when processing specially crafted mp4 files. Consequences include process crashes, but other manifestations such as code execution are not excluded. server.
Notably, a similar vulnerability was already addressed in the ngx_http_mp4_module in 2012. Additionally, F5 reported a similar vulnerability (CVE-2022-41743) in the NGINX Plus product, affecting the ngx_http_hls_module, which provides support for the HLS (Apple HTTP Live Streaming) protocol.
In addition to fixing vulnerabilities in nginx 1.23.2, the following changes have been proposed:
- Support for the variables "$proxy_protocol_tlv_*" has been added, which record the values of the TLV (Type-Length-Value) fields present in the PROXY v2 Type-Length-Value protocol.
- Automatic key rotation for TLS session ticket encryption has been implemented, used when shared memory is employed in the ssl_session_cache directive.
- The logging level for errors related to incorrect record types has been reduced from critical to informational. SSLThe logging level for messages about memory allocation failures for new sessions has been changed from alert to warn and limited to one message per second.
- On the Windows platform, a build with OpenSSL 3.0 has been established.
- Error logging for the PROXY protocol has been organized.
- A problem has been fixed where, when using TLSv1.3 based on OpenSSL or BoringSSL, the timeout specified in the "ssl_session_timeout" directive did not work.
- The release of the main branch nginx 1.23.2 has been formed, which continues the development of new features, alongside the release of the concurrently supported stable branch nginx 1.22.1, which only includes changes.
Source: opennet.ru
