{"id":182826,"date":"2026-08-11T04:54:22","date_gmt":"2026-08-11T02:54:22","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve"},"modified":"2026-08-11T04:54:22","modified_gmt":"2026-08-11T02:54:22","slug":"v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","title":{"rendered":"freenginxis ja nginxis on lisatud kontrolli tekstimuutuja suuruse \u00fcle enne, kui sinna andmeid kirjutada (+ CVE)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

<\/i><\/a>
3 <\/p>\n

TL;DR<\/b>: Seistud m\u00e4ngus, kus avastati kolmas 2026. aasta puhver\u00fclevool (ja F5 hinnangul RCE, kui ASLR pole rakendatud) regexide ja muutujate t\u00f6\u00f6tlemisel, otsustas freenginx arendaja Maksim Dunin, et on aeg see l\u00f5petada, ning lisas oma tootes kontrolli muutuja suuruse \u00fcle enne, kui sinna andmeid kirjutada. Sellest uuendusest varastati ka nginx, mis annab lootust, et uued CVE-d selle teema \u00fcmber l\u00f5petatakse.<\/p>\n

N\u00fc\u00fcd on detailid.<\/p>\n

19. juunil tehti komiteed<\/a> freenginxis, lisades muutuja descriptorisse endi v\u00e4lja, mis n\u00e4itab puhvri l\u00f5ppu. Varem oli seal vaid alguse viit (pos), vajalik pikkus arvutati (ja arvutatakse endiselt) eelnevalt ning andmete kopeerimise ajaks eeldati, et \u00f5igesti arvutatud pikkus tagab, et andmed mahuvad puhvri sisse. Kahjuks on see juba kaks korda 2026. aasta mais erinevate t\u00e4helepanematuste t\u00f5ttu nii olnud (1 (linux.org.ru)<\/a>, 2 (linux.org.ru)<\/a>), mis viis puhver\u00fclevooludeni ja halva tagaj\u00e4rjeni. N\u00fc\u00fcd, kui muutuja puhver luuakse, t\u00e4idetakse ka selle l\u00f5ppu viit, ja enne andmete kirjutamist muutuja sisse, kui andmed ei mahu sinna, t\u00f6\u00f6tlus l\u00f5petatakse kontrollitult veaga. See t\u00e4hendab, et pikkuse arvutamise vead v\u00f5ivad endiselt esineda, kuid n\u00fc\u00fcd ei purusta nad m\u00e4lu, vaid lihtsalt eba\u00f5nnestuvad konkreetse http-p\u00e4ringu osas. J\u00e4rgmised kohandused (2 (freenginx.org)<\/a>, 3 (freenginx.org)<\/a>) lisasid sarnase kaitse koodis teistesse kohtadesse, sealhulgas p\u00e4\u00e4sulogide haldamise koodi. 7. juulil avaldati versioon freenginx 1.31.3<\/a>, mis sisaldab seda parandust.<\/p>\n

<\/p>\n

15. juulil kohandati neid commite nginxis (1 (github.com)<\/a>, 2 (github.com)<\/a>, 3 (github.com)<\/a>, kuid mingil p\u00f5hjusel vahetati teise ja kolmanda koha omavahel), probleemile anti nimetus CVE-2026-42533<\/a>, ja F5 avaldas ametliku SA (f5.com)<\/a>.<\/p>\n

<\/noindex><\/p>\n

Seoses konkreetse haavatavusega seekord: see ilmneb direktiivi map kasutamisel koos regulaaravaldistega, mis sisaldavad eraldatud parameetreid. Seoses teiste vajalike tingimustega, mis selle aktiveerimiseks on vajalikud, on kommitsemise kirjelduse tekst ja SA tekst veidi erinevad: SA-s on m\u00e4rgitud, et hiljem peaks olema mingisugune stringi arvutamine, mis kasutab map'ist j\u00e4\u00e4nud eraldatud parameetrit enne selle sama map'i tulemust. Kommitsemise kirjelduse n\u00e4ites osaleb nende sammude vahel veel muutuja nullimine, mis sisaldab eraldatud parameetrit. Igal juhul on t\u00f5en\u00e4oliselt enamikus k\u00e4ivitatud nginx'ides seda harva, ning seet\u00f5ttu on haavatavus seega v\u00e4hesed inimesi puudutanud. Tuleb samuti m\u00e4rkida, et just selles juhtumis ei tundu, et oleks olemas parandusi pikkuse arvutamiseks tehtud tehtud commitides (v\u00f5i ma ei leidnud neid h\u00e4sti?), on olemas vaid kaitse, mis muudab probleemi kontrollitavaks http-p\u00e4ringu veaks. Kuigi 19. juulil lisati freenginx'isse mingeid parandusi,5bfb<\/a>, 7622<\/a>, b906<\/a>) pikkuse arvutamiseks sarnases olukorras, kuid kohe ei saa aru, kas see on see v\u00f5i mitte. <\/p>\n

Haavatavus tekkis nginx 0.9.6 versioonis, parandused j\u00f5udsid freenginx 1.31.3, nginx 1.30.4, nginx 1.31.3 versioonidesse.<\/p>\n

SA nginx-is on \u00f6eldud t\u00e4nu mitmele isikule s\u00f5ltumatute haavatavusaruannete ja \"koordineeritud teabe avalikustamise standardite\" j\u00e4rgimise eest:<\/p>\n

<\/p>\n

F5 tunnustab Ming Xuani, DKD (@pidifn), Ji\u2019an Zhou, Zhen Yani AntAISecurityLabist, Rafael Gacekit, Sergii Negodiuki EVO.companyst, Lam Jun Rongi Calif.io-st, Mufeed VH-d Winfunc Researchist (winfunc.com), Vexera AI-d (https:\/\/vexera.ai<\/a>), Tu Tran Dinh (@1w4y), Stan Shaw (cyberstan), qianshuidewajueji, zenneth (randomguy6407), Zhenpeng (Leo) Lin depthfirst'ist, Lukas Johannes Moeller, Melih Tolga Sahin Vodafone T\u00fcrkiye'st, Ayoub Nabil Boubagrat (GitHub: @ayoubnabil) ja Milan Jovic (Kljunowsky), kes t\u00f5id selle probleemi meie t\u00e4helepanu ja j\u00e4rgivad k\u00f5rgeimaid koordineeritud avaldamise standardeid.<\/p>\n

<\/noindex><\/p><\/blockquote>\n

Freenginx'is piiratakse paranduse kohta lisainformatsiooni tegelikult ainult commit'i s\u00f5numiga. \ud83e\udd47Python 3.13 | ProHoster<\/a>- see muudatus pole isegi m\u00e4rgistatud ei \"turvalisusega\" (security) ega \"veaparandusega\" (bugfix), vaid lihtsalt \"lisamisega\" (feature). T\u00f5en\u00e4oliselt ei pidanud autor seda probleemi kriitiliseks. Kuidas seondub F5 poolt nimetatud isikute probleemide raporteerimine ja freenginx'i commit, kas nad (v\u00f5i keegi teine) teatas probleemist freenginx'i autorile, ei ole selgunud. <\/p>\n

Allikas: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

3 TL;DR: \u0421\u0442\u043e\u043b\u043a\u043d\u0443\u0432\u0448\u0438\u0441\u044c \u0441 \u0442\u0440\u0435\u0442\u044c\u0438\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u043c \u0437\u0430 2026 \u0433\u043e\u0434 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0431\u0443\u0444\u0435\u0440\u0430 (\u0438, \u043f\u043e \u0432\u0435\u0440\u0441\u0438\u0438 F5, RCE \u0435\u0441\u043b\u0438 \u043d\u0435\u0442 ASLR) \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 \u0440\u0435\u0433\u044d\u043a\u0441\u043f\u0430\u043c\u0438 \u0438 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u043c\u0438, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a freenginx \u041c\u0430\u043a\u0441\u0438\u043c \u0414\u0443\u043d\u0438\u043d \u0440\u0435\u0448\u0438\u043b, \u0447\u0442\u043e \u043f\u043e\u0440\u0430 \u044d\u0442\u043e \u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0430\u0442\u044c, \u0438 \u0434\u043e\u0431\u0430\u0432\u0438\u043b \u0432 \u0441\u0432\u043e\u0439 \u043f\u0440\u043e\u0434\u0443\u043a\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0440\u0430\u0437\u043c\u0435\u0440\u0430 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u0434 \u0442\u0435\u043c \u043a\u0430\u043a \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u0432 \u043d\u0435\u0451 \u0434\u0430\u043d\u043d\u044b\u0435. \u041e\u0442\u0442\u0443\u0434\u0430 \u044d\u0442\u043e \u043d\u043e\u0432\u043e\u0432\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0443\u0442\u0430\u0449\u0438\u043b\u0438 \u043a \u0441\u0435\u0431\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":9,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-182826","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Freenginx ja nginx on lisatud kontroll tekstimuutuja suuruse \u00fcle enne, kui andmeid sinna kirjutatakse (+ CVE) | ProHoster","description":"3 TL;DR: Kolmanda avastatud bufferi \u00fcleujutusega silmitsi seistes (ja F5 versiooni kohaselt.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 freenginx \u0438 nginx \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0440\u0430\u0437\u043c\u0435\u0440\u0430 \u0442\u0435\u043a\u0441\u0442\u043e\u0432\u043e\u0439 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u0434 \u0442\u0435\u043c \u043a\u0430\u043a \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u0432 \u043d\u0435\u0451 \u0434\u0430\u043d\u043d\u044b\u0435 (+ CVE) | ProHoster","og:description":"3 TL;DR: \u0421\u0442\u043e\u043b\u043a\u043d\u0443\u0432\u0448\u0438\u0441\u044c \u0441 \u0442\u0440\u0435\u0442\u044c\u0438\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u043c \u0437\u0430 2026 \u0433\u043e\u0434 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0431\u0443\u0444\u0435\u0440\u0430 (\u0438, \u043f\u043e \u0432\u0435\u0440\u0441\u0438\u0438 F5.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-08-11T02:54:22+00:00","article:modified_time":"2026-08-11T02:54:22+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"182826","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-08-11 06:43:49","updated":"2026-08-11 06:43:49","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/182826","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=182826"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/182826\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=182826"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=182826"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=182826"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}