{"id":182826,"date":"2026-08-11T04:54:22","date_gmt":"2026-08-11T02:54:22","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve"},"modified":"2026-08-11T04:54:22","modified_gmt":"2026-08-11T02:54:22","slug":"v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","title":{"rendered":"\u00cen freenginx \u0219i nginx s-a ad\u0103ugat verificarea dimensiunii variabilei de text \u00eenainte de a scrie date \u00een aceasta (+ CVE)","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

<\/i><\/a>
3 <\/p>\n

TL;DR<\/b>: \u00cen fa\u021ba celei de-a treia dep\u0103\u0219iri a buffer-ului descoperit\u0103 \u00een 2026 (\u0219i, conform F5, RCE dac\u0103 nu exist\u0103 ASLR) \u00een timpul proces\u0103rii cu regex-uri \u0219i variabile, dezvoltatorul freenginx Maxim Dunin a decis c\u0103 este timpul s\u0103 pun\u0103 cap\u0103t acestui lucru \u0219i a ad\u0103ugat o verificare a dimensiunii variabilei \u00eenainte de a scrie date \u00een aceasta. Aceast\u0103 inova\u021bie a fost preluat\u0103 \u0219i de nginx, ceea ce d\u0103 speran\u021ba opririi apari\u021biei unor noi CVE pe aceast\u0103 tem\u0103.<\/p>\n

Iat\u0103 detalii.<\/p>\n

Pe 19 iunie a fost realizat commit<\/a> \u00een freenginx, ad\u0103ug\u00e2nd \u00een descriptorul variabilei un c\u00e2mp end, care indic\u0103 sf\u00e2r\u0219itul buffer-ului. \u00cenainte, acolo era doar un pointer la \u00eenceputul s\u0103u (pos), iar lungimea necesar\u0103 se calcula (\u0219i se calculeaz\u0103 \u00een continuare) dinainte, iar \u00een momentul copierii datelor \u00een variabil\u0103 se presupunea c\u0103 lungimea calculat\u0103 corect anterior garanteaz\u0103 c\u0103 datele vor \u00eenc\u0103pea \u00een buffer. Din p\u0103cate, de dou\u0103 ori \u00een mai 2026, din cauza unor neaten\u021bii, s-a dovedit c\u0103 nu este a\u0219a (1 (linux.org.ru)<\/a>, 2 (linux.org.ru)<\/a>), ceea ce a dus la dep\u0103\u0219iri de buffer \u0219i consecin\u021be nefaste. Ei bine, acum, la crearea buffer-ului variabilei, este completat \u0219i pointerul la sf\u00e2r\u0219itul acesteia, iar \u00eenainte de a scrie date \u00een variabil\u0103, dac\u0103 datele nu \u00eencap, procesarea solicit\u0103rii va fi controlat \u00eencheiat cu o eroare. A\u0219adar, erorile de calcul al lungimii pot exista \u00een continuare, dar acum nu vor afecta memoria, ci vor e\u0219ua doar o solicitare http specific\u0103. Urm\u0103toarele commit-uri (2 (freenginx.org)<\/a>, 3 (freenginx.org)<\/a>) au ad\u0103ugat o protec\u021bie similar\u0103 \u0219i \u00een alte p\u0103r\u021bi ale codului, inclusiv \u00een codul de gestionare a jurnalelor de acces. Pe 7 iulie, a fost publicat\u0103 versiunea freenginx 1.31.3<\/a>, care include aceast\u0103 corec\u021bie.<\/p>\n

<\/p>\n

Pe 15 iulie, aceste commit-uri au fost \u00eemprumutate de nginx (1 (github.com)<\/a>, 2 (github.com)<\/a>, 3 (github.com)<\/a>, inexplicabil, a schimbat ordinea celui de-al doilea \u0219i al treilea \u00een lan\u021b), problemei i-a fost atribuit\u0103 CVE-2026-42533<\/a>, iar F5 a lansat un SA (f5.com)<\/a>.<\/p>\n

<\/noindex><\/p>\n

Referitor la vulnerabilitatea specific\u0103 de data aceasta: aceasta se manifest\u0103 atunci c\u00e2nd se utilizeaz\u0103 directiva map cu regex-uri \u0219i parametrii extrag\u0163i. \u00cen ceea ce prive\u0219te celelalte condi\u021bii necesare pentru activarea acesteia, textul din descrierea commit-ului \u0219i textul din SA difer\u0103 pu\u021bin: \u00een SA se precizeaz\u0103 c\u0103 ar trebui s\u0103 existe o calculare a unei anumite stringuri, care utilizeaz\u0103 parametrul extras de la map, \u00eenainte de rezultatul acestui map. \u00cen descrierea commit-ului, \u00een exemplul \u00eentre aceste etape, intervine \u0219i resetarea variabilei care con\u021bine parametrul extras. Oricum, \u00een majoritatea serverelor nginx rulate, este pu\u021bin probabil ca un astfel de lucru s\u0103 fie \u00eent\u00e2lnit, iar vulnerabilitatea astfel afecteaz\u0103 pu\u021bini utilizatori. De asemenea, merit\u0103 men\u021bionat c\u0103 \u00een modific\u0103rile commit-ului, nu pare s\u0103 existe o corectare a calcul\u0103rii lungimii specifice \u00een acest caz (sau poate c\u0103 am c\u0103utat prost?), exist\u0103 doar o protec\u021bie care transform\u0103 problema \u00eentr-o eroare controlat\u0103 a cererii http. De\u0219i pe 19 iulie \u00een freenginx au fost ad\u0103ugate anumite corecturi (5bfb<\/a>, 7622<\/a>, b906<\/a>) pentru calcularea lungimii pentru o situa\u021bie similar\u0103, dar nu se poate \u00een\u021belege imediat dac\u0103 este sau nu acesta. <\/p>\n

Vulnerabilitatea a ap\u0103rut \u00een versiunea nginx 0.9.6, corecturile au fost incluse \u00een versiunile freenginx 1.31.3, nginx 1.30.4, nginx 1.31.3.<\/p>\n

\u00cen SA nginx sunt exprimate mul\u021bumiri mai multor persoane pentru rapoartele independente despre vulnerabilitate \u0219i pentru respectarea \u201estandardelor de divulgare coordonat\u0103 a informa\u021biilor\u201d:<\/p>\n

<\/p>\n

F5 \u00eei recunoa\u0219te pe Ming Xuan, DKD (@pidifn), Ji\u2019an Zhou \u0219i Zhen Yan de la AntAISecurityLab, Rafael Gacek, Sergii Negodiuk de la EVO.company, Lam Jun Rong de la Calif.io, Mufeed VH de la Winfunc Research (winfunc.com), Vexera AI (https:\/\/vexera.ai<\/a>), Tu Tran Dinh (@1w4y), Stan Shaw (cyberstan), qianshuidewajueji, zenneth (randomguy6407), Zhenpeng (Leo) Lin de la depthfirst, Lukas Johannes Moeller, Melih Tolga Sahin de la Vodafone T\u00fcrkiye, Ayoub Nabil Boubagrat (GitHub: @ayoubnabil), \u0219i Milan Jovic (Kljunowsky) pentru c\u0103 au adus aceast\u0103 problem\u0103 \u00een aten\u021bia noastr\u0103 \u00een mod independent \u0219i pentru urmarea celor mai \u00eenalte standarde de divulgare coordonat\u0103.<\/p>\n

<\/noindex><\/p><\/blockquote>\n

\u00cen freenginx, informa\u021biile \u00eenso\u021bitoare despre corecturile efectuate se limiteaz\u0103 de fapt la mesajul din commit. \u00cen changelog<\/a>- aceast\u0103 corectare nici m\u0103car nu este marcat\u0103 cu semn\u0103tura \u201esecuritate\u201d (security) sau \u201ecorectare\u201d (bugfix), ci pur \u0219i simplu \u201ead\u0103ugare\u201d (feature). Probabil, autorul nu a considerat aceast\u0103 problem\u0103 critic\u0103. Cum se raporteaz\u0103 rapoartele despre problem\u0103 din partea persoanelor men\u021bionate la F5 \u0219i commit-ul preluat din freenginx, dac\u0103 acestea (sau altcineva) au raportat problema autorului freenginx, nu s-a reu\u0219it s\u0103 se clarifice. <\/p>\n

Sursa: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

3 TL;DR: \u0421\u0442\u043e\u043b\u043a\u043d\u0443\u0432\u0448\u0438\u0441\u044c \u0441 \u0442\u0440\u0435\u0442\u044c\u0438\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u043c \u0437\u0430 2026 \u0433\u043e\u0434 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0431\u0443\u0444\u0435\u0440\u0430 (\u0438, \u043f\u043e \u0432\u0435\u0440\u0441\u0438\u0438 F5, RCE \u0435\u0441\u043b\u0438 \u043d\u0435\u0442 ASLR) \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 \u0441 \u0440\u0435\u0433\u044d\u043a\u0441\u043f\u0430\u043c\u0438 \u0438 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u043c\u0438, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a freenginx \u041c\u0430\u043a\u0441\u0438\u043c \u0414\u0443\u043d\u0438\u043d \u0440\u0435\u0448\u0438\u043b, \u0447\u0442\u043e \u043f\u043e\u0440\u0430 \u044d\u0442\u043e \u043f\u0440\u0435\u043a\u0440\u0430\u0449\u0430\u0442\u044c, \u0438 \u0434\u043e\u0431\u0430\u0432\u0438\u043b \u0432 \u0441\u0432\u043e\u0439 \u043f\u0440\u043e\u0434\u0443\u043a\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0440\u0430\u0437\u043c\u0435\u0440\u0430 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u0434 \u0442\u0435\u043c \u043a\u0430\u043a \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u0432 \u043d\u0435\u0451 \u0434\u0430\u043d\u043d\u044b\u0435. \u041e\u0442\u0442\u0443\u0434\u0430 \u044d\u0442\u043e \u043d\u043e\u0432\u043e\u0432\u0432\u0435\u0434\u0435\u043d\u0438\u0435 \u0443\u0442\u0430\u0449\u0438\u043b\u0438 \u043a \u0441\u0435\u0431\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":9,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-182826","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u00cen freenginx \u0219i nginx a fost ad\u0103ugat\u0103 o verificare a dimensiunii variabilei textuale \u00eenainte de a scrie date \u00een aceasta (+ CVE) | ProHoster","description":"3 TL;DR: Confrunt\u00e2ndu-ne cu a treia dep\u0103\u0219ire a buffer-ului descoperit\u0103 \u00een 2026 (\u0219i, conform versiunii F5.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 freenginx \u0438 nginx \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0440\u0430\u0437\u043c\u0435\u0440\u0430 \u0442\u0435\u043a\u0441\u0442\u043e\u0432\u043e\u0439 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u0434 \u0442\u0435\u043c \u043a\u0430\u043a \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0442\u044c \u0432 \u043d\u0435\u0451 \u0434\u0430\u043d\u043d\u044b\u0435 (+ CVE) | ProHoster","og:description":"3 TL;DR: \u0421\u0442\u043e\u043b\u043a\u043d\u0443\u0432\u0448\u0438\u0441\u044c \u0441 \u0442\u0440\u0435\u0442\u044c\u0438\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u043c \u0437\u0430 2026 \u0433\u043e\u0434 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0431\u0443\u0444\u0435\u0440\u0430 (\u0438, \u043f\u043e \u0432\u0435\u0440\u0441\u0438\u0438 F5.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/v-freenginx-i-nginx-dobavili-proverku-razmera-tekstovoj-peremennoj-pered-tem-kak-zapisyvat-v-neyo-dannye-cve","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-08-11T02:54:22+00:00","article:modified_time":"2026-08-11T02:54:22+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"182826","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-08-11 06:43:49","updated":"2026-08-11 06:43:49","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/182826","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=182826"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/182826\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=182826"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=182826"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=182826"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}