Ewepụtala mwepụta mbụ nke ngalaba isi ọhụrụ nke nginx 1.27.0, n'ime nke mmepe nke njirimara ọhụrụ ga-aga n'ihu. N'otu oge ahụ, a tọhapụrụ nginx 1.26.1, nke bụ nke alaka ụlọ ọrụ kwụsiri ike na-akwado, nke na-agụnye naanị mgbanwe ndị metụtara iwepụ nnukwu njehie na adịghị ike. N'afọ na-abịa, dabere na isi alaka 1.27.x, a ga-emepụta alaka siri ike 1.28. Edere koodu ọrụ ahụ na C wee kesaa n'okpuru ikikere BSD.
Mwepụta ọhụrụ a na-edozi adịghị ike 4 na-emetụta modul ngx_http_v3 nnwale (nwere nkwarụ na ndabara), nke na-enye nkwado maka protocol HTTP/3 site na iji QUIC protocol dị ka njem maka HTTP/2. Nsogbu na-apụta naanị mgbe ngx_http_v3_module modul arụnyere na edobere nhọrọ “quic” na ntuziaka “ntị”. Enweghị okwu ọ bụla gbasara adịghị ike nke ndụdụ Angie na FreeNginx.
Ọdịmma CVE-2024-34161 na-eme ka ebe nchekwa usoro ndị ọrụ gbasaa na sistemụ nwere uru MTU karịrị 4096 bytes. Mwepu ebe nchekwa na-eme mgbe ezipu okpokolo agba CRYPTO eji na mkparita uka njikọ ka onye ahịa zipụchara ozi mmecha.
CVE-2024-31079, CVE-2024-32760, na CVE-2024-35200 adịghị ike nrụrụ ebe nchekwa na-ekwe ka onye na-awakpo dịpụrụ adịpụ mebie usoro onye ọrụ nginx site n'ịmepụta nnọkọ ahaziri nke ọma dabere na QUIC protocol. N'otu oge ahụ, maka adịghị ike CVE-2024-31079 na CVE-2024-32760, enweghị ike ịwepụ nsonaazụ ndị ọzọ nke mwakpo ahụ (nwere ike ịme koodu onye mwakpo ahụ?). A naghị enye nkọwa, mana na-ekpe ikpe site na mgbazi na koodu ahụ, nsogbu ndị ahụ na-akpata site na ịnweta ebe nchekwa a tọhapụrụ (eji ya emechaa n'efu), oke ebe nchekwa na-ezighi ezi maka nhazi, nkwụsị pointer null na enweghị nlele kwesịrị ekwesị nke nha. data etinyere na nchekwa.
N'ime mgbanwe ndị na-emetụtaghị mkpochapụ nke adịghị ike na nginx 1.27.0:
- Agbakwunyela nkwado maka ịkọwapụta mgbanwe na ntuziaka "proxy_limit_rate", "fastcgi_limit_rate", "scgi_limit_rate" na "uwsgi_limit_rate".
- Mbelata oriri ebe nchekwa mgbe ị na-ahazi arịrịọ ogologo ndụ na nhazi nke na-eji ntuziaka "gzip", "gunzip", "ssi", "sub_filter" ma ọ bụ "grpc_pass".
- Edere nsogbu na nrụpụta na GCC 14 mgbe ị na-eji nhọrọ "--with-atomic".
- Edozila ahụhụ dị na mmejuputa HTTP/3.
Na mgbakwunye, anyị nwere ike ịhụ mbipụta nke ngalaba isi ọhụrụ nke FreeNginx 1.27.0, ndụdụ nke Nginx nke Maxim Dunin mepụtara, otu n'ime isi mmalite nke Nginx. A na-edobe FreeNginx dị ka ọrụ anaghị akwụ ụgwọ nke na-enye mmepe nke koodu Nginx na-enweghị enyemaka ụlọ ọrụ. Ụdị ọhụrụ ahụ emeziwanyela njikwa njehie mgbe ị na-agụ akwụkwọ arịrịọ, mgbakọ na-emeziwanye na NetBSD 10.0, yana idezi faịlụ PID dị mma (agbakwunyere "gbanyụọ" na ntụziaka "pid").
isi: opennet.ru
