{"id":121724,"date":"2025-02-06T09:46:03","date_gmt":"2025-02-06T07:46:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovleniya-nginx-1-26-3-i-1-27-4-s-ustraneniem-uyazvimosti-svyazannoj-s-tls"},"modified":"2025-02-06T09:46:03","modified_gmt":"2025-02-06T07:46:03","slug":"obnovleniya-nginx-1-26-3-i-1-27-4-s-ustraneniem-uyazvimosti-svyazannoj-s-tls","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/news\/obnovleniya-nginx-1-26-3-i-1-27-4-s-ustraneniem-uyazvimosti-svyazannoj-s-tls","title":{"rendered":"Aggiornamenti nginx 1.26.3 e 1.27.4 che risolvono una vulnerabilit\u00e0 relativa al TLS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>\u00c8 stato rilasciato l'aggiornamento della versione principale di nginx 1.27.4, che continuer\u00e0 a sviluppare nuove funzionalit\u00e0, insieme al rilascio di una versione stabile supportata parallelamente, nginx 1.26.3, che riceve solo aggiornamenti mirati alla risoluzione di errori critici e vulnerabilit\u00e0. Negli aggiornamenti \u00e8 stata corretta una vulnerabilit\u00e0 (CVE-2025-23419) che permetteva di eludere il controllo dei certificati TLS del client.       <\/p>\n<p>La vulnerabilit\u00e0 \u00e8 causata dalla mancanza di adeguate verifiche nella gestione degli host virtuali legati a un singolo indirizzo IP e numero di porta, selezionati quando ci si collega tramite HTTPS in base al nome di dominio fornito attraverso l'estensione SNI di TLS. In tali configurazioni, un attaccante potrebbe riutilizzare la sessione TLS nel contesto di un altro host virtuale per eludere l'autenticazione con il certificato TLS del client. Il problema si manifesta in configurazioni che supportano il rinnovo delle sessioni TLS tramite \"TLS session ticket\" o utilizzano la cache delle sessioni TLS nelle impostazioni. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/it\/server\/dts-los-angeles\/\"   title=\"server\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"3903\">server<\/a> comportamento predefinito, in cui viene utilizzata l'autenticazione tramite certificati TLS del client. La vulnerabilit\u00e0 \u00e8 presente a partire dalla versione 1.11.4 di nginx, compilata con OpenSSL e con il protocollo TLSv1.3 abilitato.     <\/p>\n<p>Modifiche non correlate alla sicurezza:  <\/p>\n<ul>\n<li class=\"l\"> Sono state aggiunte funzionalit\u00e0 per ridurre il consumo di risorse e diminuire il carico sulla CPU durante l'uso del TLS in configurazioni con un numero elevato di blocchi server e location. Le modifiche aggiunte consentono di utilizzare un contesto SSL gi\u00e0 esistente dal blocco padre invece di crearne uno separato per ciascun blocco di configurazione (SSL_CTX in OpenSSL).\n<li class=\"l\"> Sono stati risolti i problemi con il lungo tempo di caricamento dei file di configurazione a causa della ripetuta analisi dello stesso insieme <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/it\/ssl-sertifikat\/\"   title=\"di certificati TLS\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"966\">di certificati TLS<\/a>, chiavi e elenchi di autorit\u00e0 di certificazione. \u00c8 stata accelerata la ricarica della configurazione grazie al riutilizzo degli oggetti TLS invariati, come certificati, chiavi e CRL. Per disattivare l'ereditariet\u00e0 degli oggetti durante l'aggiornamento della configurazione, \u00e8 stata aggiunta la direttiva \"ssl_object_cache_inheritable\".\n<li class=\"l\"> Aggiunto un cache per certificati e chiavi caricate utilizzando variabili nelle direttive (ad esempio, &#171;ssl_certificate      \/etc\/ssl\/$ssl_server_name.crt&#187;). Sono state aggiunte le direttive &#171;ssl_certificate_cache&#187;, &#171;proxy_ssl_certificate_cache&#187;, &#171;grpc_ssl_certificate_cache&#187; e &#171;uwsgi_ssl_certificate_cache&#187; per gestire la cache. Tramite queste direttive, \u00e8 possibile configurare la dimensione massima della cache, la durata delle registrazioni e il periodo di pulizia delle voci non richieste. Ad esempio: &#171;ssl_certificate_cache max=1000 inactive=20s valid=1m;&#187;.\n<li class=\"l\"> \u00c8 stata aggiunta la direttiva &#171;keepalive_min_timeout&#187;, che definisce il timeout durante il quale nginx non chiuder\u00e0 la connessione keep-alive con il client.\n<li class=\"l\"> \u00c8 stato risolto il problema della comparsa nei log del messaggio \"gzip filter failed to use preallocated memory\" durante la compilazione con la libreria zlib-ng.\n<li class=\"l\"> \u00c8 stato risolto il problema con la compilazione della libreria libatomic, utilizzando l'opzione di compilazione \"--with-libatomic=DIR\".\n<li class=\"l\"> Eliminato un errore che impediva l'instaurazione di una connessione tramite il protocollo QUIC durante l'utilizzo di 0-RTT.\n<li class=\"l\"> Garantito l'ignore delle richieste di negoziazione delle versioni QUIC provenienti dai client.\n<li class=\"l\"> Risolti problemi di compilazione in Solaris 10 con il modulo ngx_http_v3_module.\n<li class=\"l\"> Corrette le problematiche nell'implementazione di HTTP\/3.    <\/ul>\n<p>Fonte: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=62679\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 nginx 1.27.4, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442\u0441\u044f \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0435\u0439, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 nginx 1.26.3, \u0432 \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u0432\u043d\u043e\u0441\u044f\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0441\u0435\u0440\u044c\u0451\u0437\u043d\u044b\u0445 \u043e\u0448\u0438\u0431\u043e\u043a \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u0412 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2025-23419), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u0438\u0445 TLS-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435\u043c \u0434\u043e\u043b\u0436\u043d\u044b\u0445 \u043f\u0440\u043e\u0432\u0435\u0440\u043e\u043a \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432, \u043f\u0440\u0438\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u043a [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-121724","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 nginx 1.27.4, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442\u0441\u044f \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0435\u0439, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 nginx 1.26.3, \u0432 \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u0432\u043d\u043e\u0441\u044f\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/it\/blog\/news\/obnovleniya-nginx-1-26-3-i-1-27-4-s-ustraneniem-uyazvimosti-svyazannoj-s-tls\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"it_IT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f nginx 1.26.3 \u0438 1.27.4 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 TLS | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 nginx 1.27.4, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442\u0441\u044f \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0435\u0439, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 nginx 1.26.3, \u0432 \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u0432\u043d\u043e\u0441\u044f\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/it\/blog\/news\/obnovleniya-nginx-1-26-3-i-1-27-4-s-ustraneniem-uyazvimosti-svyazannoj-s-tls\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2025-02-06T07:46:03+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2025-02-06T07:46:03+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Aggiornamenti di nginx 1.26.3 e 1.27.4 per la correzione di vulnerabilit\u00e0 relative a TLS | ProHoster","description":"\u00c8 stata rilasciata la versione principale di nginx 1.27.4, nell'ambito della quale continuano a svilupparsi nuove funzionalit\u00e0, cos\u00ec come il rilascio della versione stabile parallela nginx 1.26.3, alla quale vengono apportate solo modifiche.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/news\/obnovleniya-nginx-1-26-3-i-1-27-4-s-ustraneniem-uyazvimosti-svyazannoj-s-tls","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f nginx 1.26.3 \u0438 1.27.4 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 TLS | ProHoster","og:description":"\u0421\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 nginx 1.27.4, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u0442\u0441\u044f \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u0435 \u043d\u043e\u0432\u044b\u0445 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0435\u0439, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u0441\u0442\u0430\u0431\u0438\u043b\u044c\u043d\u043e\u0439 \u0432\u0435\u0442\u043a\u0438 nginx 1.26.3, \u0432 \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u0432\u043d\u043e\u0441\u044f\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f.","og:url":"https:\/\/prohoster.info\/it\/blog\/news\/obnovleniya-nginx-1-26-3-i-1-27-4-s-ustraneniem-uyazvimosti-svyazannoj-s-tls","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-02-06T07:46:03+00:00","article:modified_time":"2025-02-06T07:46:03+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"121724","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-22 15:49:11","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 10:21:20","updated":"2026-02-22 15:49:11","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/121724","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=121724"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/121724\/revisions"}],"predecessor-version":[{"id":162431,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/121724\/revisions\/162431"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=121724"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=121724"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=121724"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}