{"id":182826,"date":"2026-08-11T04:54:22","date_gmt":"2026-08-11T02:54:22","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve"},"modified":"2026-08-11T04:54:22","modified_gmt":"2026-08-11T02:54:22","slug":"v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","title":{"rendered":"Freenginxis ja nginxis lisati kontroll tekstimuutuja suuruse \u00fcle enne andmete salvestamist (+ CVE)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

<\/i><\/a>
3 <\/p>\n

TL;DR<\/b>: Kohtudes 2026. aastal avastatud kolmanda puhver\u00fclesega (ja F5 versiooni j\u00e4rgi RCE, kui ASLR pole) regulaarsete v\u00e4ljendite ja muutuja t\u00f6\u00f6tluse k\u00e4igus, otsustas arendaja freenginxil, Maksim Dunin, et on aeg see l\u00f5petada ning lisas oma tootes muutuja suuruse kontrolli enne andmete selle kirjutamist. Sealt v\u00f5eti see uuendus endaga kaasa ka nginx, mis annab lootust uute CVE-de l\u00f5petamiseks selle teema osas.<\/p>\n

N\u00fc\u00fcd \u00fcksikasjad.<\/p>\n

19. juunil tehti kommitt<\/a> freenginxis, mis lisab muutuja descriptorisse l\u00f5pu v\u00e4lja, mis n\u00e4itab puhveri l\u00f5ppu. Varem oli seal ainult alguse n\u00e4itaja (pos), vajalik pikkus arvutati (ja arvutatakse endiselt) ette, ja andmete muutuja copy momentil eeldati, et \u00f5igesti varem arvutatud pikkus garanteerib, et andmed mahuvad puhvri sisse. Kahjuks on mai 2026. aastal mitmete erinevate unustamiste t\u00f5ttu selgunud, et see pole alati nii (1 (linux.org.ru)<\/a>, 2 (linux.org.ru)<\/a>), mis viis puhver\u00fcletusteni ja halbadeni tagaj\u00e4rgedeni. Nii et n\u00fc\u00fcd, kui puhvri muutuja luuakse, t\u00e4idetakse ka n\u00e4itaja selle l\u00f5pus ning enne andmete kirjutamist muutuja, kui andmed ei mahu, kontrollitakse taotluse t\u00f6\u00f6tlemise l\u00f5petamist veaga. See t\u00e4hendab, et pikkuse arvutamise vead v\u00f5ivad j\u00e4tkuvalt esineda, kuid need ei l\u00f5hke enam m\u00e4lu, vaid eba\u00f5nnestuvad ainult konkreetse http-p\u00e4ringu. J\u00e4rgmiste commit'idega (2 (freenginx.org)<\/a>, 3 (freenginx.org)<\/a>) lisati sarnane kaitse ka teistesse koodikohtadesse, sealhulgas access-logi haldamise koodi. 7. juulil avaldati versioon freenginx 1.31.3<\/a>, mis sisaldab seda parandust.<\/p>\n

<\/p>\n

15. juulil v\u00f5eti need commit'id nginx-i poolt (1 (github.com)<\/a>, 2 (github.com)<\/a>, 3 (github.com)<\/a>, mikski olid teise ja kolmanda vahetuses), probleemile m\u00e4\u00e4rati CVE-2026-42533<\/a>, ja F5 v\u00e4ljastas ametliku SA (f5.com)<\/a>.<\/p>\n

<\/noindex><\/p>\n

Konkreetse haavatavuse osas: see ilmneb map direktiivi kasutamisel regulaaravaldistega koos eraldatud parameetritega. \u00dclej\u00e4\u00e4nud vajalike tingimuste osas, mis selle aktiveerimiseks vajalikud, erinedavad commit'i kirjelduses olev tekst ja SA tekst veidi: SA-s on m\u00e4rgitud, et hiljem peaks olema mingi stringi arvutamine, mis kasutab map suurelt eraldatud parameetrit, enne selle sama map'i tulemust. Commit'i kirjelduses osaleb nende sammude vahel veel muutuja nullimine, mis sisaldab eraldatud parameetrit. Igal juhul, enamikul k\u00e4ivitatud nginx-edest seda t\u00f5en\u00e4oliselt ei esine ja seet\u00f5ttu on haavatavus v\u00e4he kellelegi m\u00f5junud. Tuleb m\u00e4rkida, et t\u00e4pselt selles juhtumis ei paista olevat parandusi konkreetse pikkuse arvutamise kohta (v\u00f5i ma ei leidnud neid piisavalt h\u00e4sti?), seal on ainult kaitse, mis muudab probleemi kontrollitud http-p\u00e4ringu eba\u00f5nnestumiseks. Kuigi 19. juulil lisati freenginx-i mingid parandused (5bfb<\/a>, 7622<\/a>, b906<\/a>) sarnase olukorra pikkuse arvutamiseks, kuid kohe ei ole selge, kas see on see v\u00f5i mitte. <\/p>\n

Haavatavus ilmnes nginx versioonis 0.9.6, parandused j\u00f5udsid freenginx versioonidesse 1.31.3, nginx 1.30.4, nginx 1.31.3.<\/p>\n

SA nginx-is on t\u00e4nu m\u00f5nele isikule, kes on esitanud s\u00f5ltumatuid haavatavuse teateid ja j\u00e4rgib «koordineeritud teabe avaldamise standardeid»;<\/p>\n

<\/p>\n

F5 tunnustab Ming Xuanit, DKD (@pidifn), Ji’an Zhou, ja Zhen Yan\u2019i AntAISecurityLabist, Rafael Gacekit, Sergii Negodiuki EVO.companyst, Lam Jun Rongit Calif.io-st, Mufeed VH-d Winfunc Researchist (winfunc.com), Vexera AI-d (https:\/\/vexera.ai<\/a>), Tu Tran Dinh (@1w4y), Stan Shaw'd (cyberstan), qianshuidewajueji, zenneth'i (randomguy6407), Zhenpeng (Leo) Lin'i depthfirst'ist, Lukas Johannes Moelleri, Melih Tolga Sahin'i Vodafone T\u00fcrkiyest, Ayoub Nabil Boubagrat'it (GitHub: @ayoubnabil) ja Milan Jovic'it (Kljunowsky) selle k\u00fcsimusega meile t\u00e4helepanu juhtimise eest ja k\u00f5rgeimate koordineeritud avalikustamise standardite j\u00e4rgimise eest.<\/p>\n

<\/noindex><\/p><\/blockquote>\n

Freenginx'i asjakohane teave parandamise osas piirneb tegelikult commit'i kohta k\u00e4iva teadetega. changelog<\/a>- see parandamine ei ole t\u00e4histatud ei «turvalisuse» (security) ega «paranduse» (bugfix) all, vaid lihtsalt «lisamise» (feature) all. T\u00f5en\u00e4oliselt ei pidanud autor seda probleemi kriitiliseks. Kuidas seostuvad F5 poolt nimetatud isikute probleemiteated ning freenginx-ist laenatud commit, kas nad (v\u00f5i keegi teine) teatasid probleemist freenginx autori jaoks, ei \u00f5nnestunud v\u00e4lja selgitada. <\/p>\n

Allikas: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

3 TL;DR: \u0421\u0442\u043e\u043b\u043a\u043d\u0443\u0432\u0448\u0438\u0441\u044c \u0441 \u0442\u0440\u0435\u0442\u044c\u0438\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u043c \u0437\u0430 2026 \u0433\u043e\u0434 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0431\u0443\u0444\u0435\u0440\u0430 (\u0438, \u043f\u043e \u0432\u0435\u0440\u0441\u0438\u0438 F5, RCE \u0435\u0441\u043b\u0438 \u043d\u0435\u0442 ASLR) \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 \u0440\u0435\u0433\u044d\u043a\u0441\u043f\u0430\u043c\u0438 \u0438 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u043c\u0438, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a freenginx \u041c\u0430\u043a\u0441\u0438\u043c \u0414\u0443\u043d\u0438\u043d \u0440\u0435\u0448\u0438\u043b, \u0447\u0442\u043e \u043f\u043e\u0440\u0430 \u044d\u0442\u043e \u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0430\u0442\u044c, \u0438 \u0434\u043e\u0431\u0430\u0432\u0438\u043b \u0432 \u0441\u0432\u043e\u0439 \u043f\u0440\u043e\u0434\u0443\u043a\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0440\u0430\u0437\u043c\u0435\u0440\u0430 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u0434 \u0442\u0435\u043c \u043a\u0430\u043a \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u0432 \u043d\u0435\u0451 \u0434\u0430\u043d\u043d\u044b\u0435. \u041e\u0442\u0442\u0443\u0434\u0430 \u044d\u0442\u043e \u043d\u043e\u0432\u043e\u0432\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0443\u0442\u0430\u0449\u0438\u043b\u0438 \u043a \u0441\u0435\u0431\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":9,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-182826","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Freenginxis ja nginxis on lisatud kontroll tekstimuutuja suuruse \u00fcle enne andmete kirjutamist (+ CVE) | ProHoster","description":"3 TL;DR: Kohtudes 2026. aastal kolmandat korda tuvastatud puhverdus\u00fclekandega (ja F5 versiooni kohaselt.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 freenginx \u0438 nginx \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0440\u0430\u0437\u043c\u0435\u0440\u0430 \u0442\u0435\u043a\u0441\u0442\u043e\u0432\u043e\u0439 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u0434 \u0442\u0435\u043c \u043a\u0430\u043a \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u0432 \u043d\u0435\u0451 \u0434\u0430\u043d\u043d\u044b\u0435 (+ CVE) | ProHoster","og:description":"3 TL;DR: \u0421\u0442\u043e\u043b\u043a\u043d\u0443\u0432\u0448\u0438\u0441\u044c \u0441 \u0442\u0440\u0435\u0442\u044c\u0438\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u043c \u0437\u0430 2026 \u0433\u043e\u0434 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0431\u0443\u0444\u0435\u0440\u0430 (\u0438, \u043f\u043e \u0432\u0435\u0440\u0441\u0438\u0438 F5.","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-08-11T02:54:22+00:00","article:modified_time":"2026-08-11T02:54:22+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/182826","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=182826"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/182826\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=182826"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=182826"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=182826"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}