{"id":100280,"date":"2021-05-25T22:22:55","date_gmt":"2021-05-25T20:22:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypuski-nginx-1-21-0-i-nginx-1-20-1-s-ustraneniem-uyazvimosti"},"modified":"2021-05-25T22:22:55","modified_gmt":"2021-05-25T20:22:55","slug":"vypuski-nginx-1-21-0-i-nginx-1-20-1-s-ustraneniem-uyazvimosti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/vypuski-nginx-1-21-0-i-nginx-1-20-1-s-ustraneniem-uyazvimosti","title":{"rendered":"Releases nginx 1.21.0 and nginx 1.20.1 with vulnerability fixes.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The first release of the new main branch nginx 1.21.0 has been announced, which will continue to develop new features. At the same time, a corrective release of the parallel stable branch 1.20.1 has been prepared, which includes only changes related to fixing serious bugs and vulnerabilities. A stable branch 1.22 will be formed next year based on the main branch 1.21.x. <\/p>\n
The latest versions have addressed a vulnerability (CVE-2021-23017) in the code for host name resolution in DNS, which could lead to crashes or potentially allow an attacker to execute code. The issue occurs when processing certain responses from the DNS server, resulting in a one-byte buffer overflow. The vulnerability manifests only when enabled in the DNS resolver settings using the 'resolver' directive. To perform an attack, the attacker must be able to spoof UDP packets from the DNS server or gain control over the DNS server. This vulnerability has been present since the release of nginx 0.6.18. To resolve the issue in older releases, a patch can be applied. <\/p>\n
Changes in nginx 1.21.0 unrelated to security: <\/p>\n
\n
Support for variables has been added to the directives «proxy_ssl_certificate», «proxy_ssl_certificate_key», «grpc_ssl_certificate», «grpc_ssl_certificate_key», «uwsgi_ssl_certificate», and «uwsgi_ssl_certificate_key».\n
Support for 'pipelining' has been added to the mail proxy module for sending multiple POP3 or IMAP requests in a single connection, as well as a new 'max_errors' directive that specifies the maximum number of protocol errors after which the connection will be closed.\n
The stream module now includes the «fastopen» parameter, enabling «TCP Fast Open» mode for listening sockets.\n
Issues with escaping special characters during automatic redirects with a trailing slash have been resolved.\n
The problem with closing connections to clients when using SMTP pipelining has been fixed. <\/ul>\n