{"id":116173,"date":"2024-05-30T00:20:28","date_gmt":"2024-05-29T22:20:28","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/novaya-versiya-nginx-1-27-0-c-ustraneniem-4-uyazvimostej-v-realizaczii-http-3"},"modified":"2024-05-30T00:20:28","modified_gmt":"2024-05-29T22:20:28","slug":"novaya-versiya-nginx-1-27-0-c-ustraneniem-4-uyazvimostej-v-realizaczii-http-3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/novaya-versiya-nginx-1-27-0-c-ustraneniem-4-uyazvimostej-v-realizaczii-http-3","title":{"rendered":"The new version of nginx 1.27.0 addresses 4 vulnerabilities in the HTTP\/3 implementation.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The first release of the new main branch nginx 1.27.0 has been introduced, in which the development of new features will continue. At the same time, nginx 1.26.1 has been formed, which belongs to the concurrently supported stable branch, where only changes related to fixing serious bugs and vulnerabilities are made. Next year, a stable branch 1.28 will be created based on the main branch 1.27.x. The project code is written in C language and is distributed under the BSD license. <\/p>\n
The new releases address four vulnerabilities affecting the experimental ngx_http_v3 module (which is disabled by default) that supports the HTTP\/3 protocol, using QUIC as the transport for HTTP\/2. These issues only manifest when the ngx_http_v3_module is activated and the «quic» option is set in the «listen» directive. There are currently no reports regarding the vulnerability exposure of the Angie and FreeNginx forks. <\/p>\n
The vulnerability CVE-2024-34161 leads to memory content leakage of the worker process on systems with an MTU set to more than 4096 bytes. The memory content leak occurs when sending CRYPTO frames used during the connection handshake, after the client has sent the finalizing message. <\/p>\n
The vulnerabilities CVE-2024-31079, CVE-2024-32760, and CVE-2024-35200 are caused by memory corruption and allow a remote attacker to crash the nginx worker process by establishing a specially crafted session based on the QUIC protocol. For vulnerabilities CVE-2024-31079 and CVE-2024-32760, other attack consequences (potential remote code execution?) cannot be ruled out. Details are not given, but judging by the code fixes, the vulnerabilities are caused by accessing already freed memory (use-after-free), improper memory allocation for an array, dereferencing a null pointer, and insufficient checking of the size of the data placed in the buffer. <\/p>\n
Among the changes in nginx 1.27.0 that are unrelated to vulnerability fixes: <\/p>\n
\n
Support for variable specifications has been added to the «proxy_limit_rate», «fastcgi_limit_rate», «scgi_limit_rate», and «uwsgi_limit_rate» directives.\n
Memory consumption has been reduced when processing long-lived requests in configurations using the «gzip», «gunzip», «ssi», «sub_filter», or «grpc_pass» directives.\n
Issues related to crashes in GCC 14 with the «—with-atomic» option have been resolved.\n
Errors in the implementation of HTTP\/3 have been fixed. <\/ul>\n
Additionally, a new main branch of FreeNginx 1.27.0 has been released, a fork of Nginx developed by Maxim Dunin, one of the key developers of Nginx. FreeNginx is positioned as a non-commercial project, ensuring the development of the Nginx codebase without corporate interference. The new version improves error handling during request body reading, establishes compilation in NetBSD 10.0, and enhances PID file writing (with the «off» parameter added to the «pid» directive). \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"