{"id":166097,"date":"2026-03-25T11:12:50","date_gmt":"2026-03-25T09:12:50","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovleniya-nginx-1-29-7-i-1-28-3-s-ustraneniem-6-uyazvimostej"},"modified":"2026-03-25T11:12:50","modified_gmt":"2026-03-25T09:12:50","slug":"obnovleniya-nginx-1-29-7-i-1-28-3-s-ustraneniem-6-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/nl\/blog\/news\/obnovleniya-nginx-1-29-7-i-1-28-3-s-ustraneniem-6-uyazvimostej","title":{"rendered":"Updates voor nginx 1.29.7 en 1.28.3 met het verhelpen van 6 kwetsbaarheden","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
De uitgave van de hoofdversie nginx 1.29.7 is gevormd, waarin de ontwikkeling van nieuwe mogelijkheden doorgaat, evenals de uitgave van de parallel ondersteunende stabiele versie nginx 1.28.3, waarvoor alleen wijzigingen worden doorgevoerd die verband houden met het oplossen van ernstige fouten en kwetsbaarheden. In de updates zijn 6 kwetsbaarheden verholpen, waarvan er drie leiden tot een buffer overflow. Vier kwetsbaarheden zijn geclassificeerd met een hoog gevaar niveau (8.8 of 8.5 op 10). <\/p>\n
\n
CVE-2026-27654 \u2014 buffer overflow in the ngx_http_dav_module when processing WebDAV COPY and MOVE requests using the alias directive in location blocks. This vulnerability allows changing file paths to access outside the base directory. The issue was identified using the AI model Claude.\n
CVE-2026-27784, CVE-2026-32647 \u2014 buffer overflows in the ngx_http_mp4_module occurring when processing specially crafted mp4 files. It is not excluded that exploitation of the vulnerability may lead to a crash of the worker process.\n
CVE-2026-27651 \u2014 null pointer dereference when improperly using CRAM-MD5 or APOP authentication methods.\n
CVE-2026-28753 \u2014 ability to manipulate PTR records in DNS to inject attacker data into auth_http requests and the XCLIENT command in SMTP connections to the backend.\n
CVE-2026-28755 \u2014 bypass of OCSP certificate verification results in the stream module. <\/ul>\n
Onder de niet-veiligheidsgerelateerde wijzigingen in nginx 1.29.7. <\/p>\n
\n
Ondersteuning voor het Multipath TCP (MPTCP) protocol is toegevoegd, dat het mogelijk maakt om pakketten gelijktijdig over meerdere routes via verschillende netwerkinterfaces te verzenden. Om dit in te schakelen, is de parameter 'multipath' toegevoegd aan de 'listen' directive.\n
The keepalive directive used in the upstream block now includes the local parameter. When this parameter is specified, instead of sharing a single connection to a common upstream server referenced in different location and server blocks, each block maintains a separate connection to the upstream.\n
The keepalive directive has been activated by default in the upstream block.\n
When using proxy mode, the HTTP\/1.1 protocol version is set by default with keep-alive mode enabled (the ngx_http_proxy_module has keep-alive support enabled by default and the value '1.1' has been set in the proxy_http_version directive, and the sending of the 'Connection' header has been disabled by default). To revert to the old behavior allowing access to backends that only support HTTP\/1.0, the following settings should be specified: proxy_http_version 1.0; proxy_set_header Connection 'Close'; <\/ul>\n