{"id":116173,"date":"2024-05-30T00:20:28","date_gmt":"2024-05-29T22:20:28","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/novaya-versiya-nginx-1-27-0-c-ustraneniem-4-uyazvimostej-v-realizaczii-http-3"},"modified":"2024-05-30T00:20:28","modified_gmt":"2024-05-29T22:20:28","slug":"novaya-versiya-nginx-1-27-0-c-ustraneniem-4-uyazvimostej-v-realizaczii-http-3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/novaya-versiya-nginx-1-27-0-c-ustraneniem-4-uyazvimostej-v-realizaczii-http-3","title":{"rendered":"Versioni e re nginx 1.27.0 me rregullimin e 4 dob\u00ebsive n\u00eb implementimin e HTTP\/3","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
U dha l\u00ebshimi i par\u00eb i deg\u00ebs kryesore t\u00eb re nginx 1.27.0, n\u00eb kuad\u00ebr t\u00eb s\u00eb cil\u00ebs do t\u00eb vazhdoj\u00eb zhvillimi i mund\u00ebsive t\u00eb reja. Nj\u00ebkoh\u00ebsisht u formua l\u00ebshimi nginx 1.26.1, i lidhur me deg\u00ebn stabile q\u00eb mbahet paralelisht, n\u00eb t\u00eb cil\u00ebn b\u00ebhen vet\u00ebm ndryshime q\u00eb lidhen me eliminimin e gabimeve t\u00eb r\u00ebnda dhe dob\u00ebsive. Vitin e ardhsh\u00ebm, n\u00eb baz\u00eb t\u00eb deg\u00ebs kryesore 1.27.x do t\u00eb formohet dega stabile 1.28. Kodi i projektit \u00ebsht\u00eb shkruar n\u00eb gjuh\u00ebn C dhe shp\u00ebrndahet n\u00ebn licenc\u00ebn BSD. <\/p>\n
N\u00eb versionet e reja jan\u00eb eliminuar 4 dob\u00ebsi, t\u00eb cilat prekin modulin eksperimental ngx_http_v3 (i cili \u00ebsht\u00eb i \u00e7aktivizuar me defaut), q\u00eb ofron mb\u00ebshtetje p\u00ebr protokollin HTTP\/3, duke p\u00ebrdorur protokollin QUIC si transport p\u00ebr HTTP\/2. Problemet shfaqen vet\u00ebm kur aktivizohet moduli ngx_http_v3_module dhe opsioni \u00abquic\u00bb vendoset n\u00eb drejtorin\u00eb \u00ablisten\u00bb. Nuk ka informacione p\u00ebr ndjeshm\u00ebrin\u00eb ndaj dob\u00ebsive t\u00eb forkave Angie dhe FreeNginx deri tani. <\/p>\n
Dob\u00ebsia CVE-2024-34161 \u00e7on n\u00eb rrjedhjen e p\u00ebrmbajtjes s\u00eb memories s\u00eb procesit n\u00eb sistemet me MTU t\u00eb vendosur n\u00eb nj\u00eb vler\u00eb m\u00eb t\u00eb madhe se 4096 byte. Rrjedhja e p\u00ebrmbajtjes s\u00eb memories ndodh n\u00eb rastin e d\u00ebrgimit t\u00eb kuadrove CRYPTO, t\u00eb p\u00ebrdorura gjat\u00eb negociatave t\u00eb lidhjes, n\u00eb faz\u00ebn pas d\u00ebrgimit t\u00eb mesazhit p\u00ebrfundimtar nga klienti. <\/p>\n
Dob\u00ebsi t\u00eb tjera CVE-2024-31079, CVE-2024-32760 dhe CVE-2024-35200 shkaktohen nga d\u00ebmtimi i memories dhe lejojn\u00eb nj\u00eb sulmues t\u00eb larg\u00ebt t\u00eb shkaktoj\u00eb ndalimin e procesit nginx p\u00ebrmes vendosjes s\u00eb nj\u00eb seance t\u00eb dizajnuar posa\u00e7\u00ebrisht q\u00eb bazohet n\u00eb protokollin QUIC. P\u00ebr dob\u00ebsit\u00eb CVE-2024-31079 dhe CVE-2024-32760 nuk p\u00ebrjashtohen pasojat e tjera t\u00eb sulmit (mund\u00ebsia p\u00ebr ekzekutimin e kodit t\u00eb sulmuesit?). Detajet nuk jan\u00eb dh\u00ebn\u00eb, por sipas rregullimeve n\u00eb kod, dob\u00ebsit\u00eb shkaktohen nga qasja n\u00eb kujtes\u00eb q\u00eb tashm\u00eb \u00ebsht\u00eb liruar (use-after-free), ndarjen e gabuar t\u00eb memories p\u00ebr nj\u00eb masiv, dereferencimi i nj\u00eb treguesi nul dhe mungesa e kontrollit t\u00eb duhur t\u00eb madh\u00ebsis\u00eb s\u00eb t\u00eb dh\u00ebnave t\u00eb vendosura n\u00eb buf\u00ebr. <\/p>\n
Mes ndryshimeve q\u00eb nuk lidhen me eliminimin e dob\u00ebsive n\u00eb nginx 1.27.0: <\/p>\n
\n
N\u00eb drejtorit\u00eb \u00abproxy_limit_rate\u00bb, \u00abfastcgi_limit_rate\u00bb, \u00abscgi_limit_rate\u00bb dhe \u00abuwsgi_limit_rate\u00bb \u00ebsht\u00eb shtuar mb\u00ebshtetje p\u00ebr caktimin e variablave.\n
N\u00eb m\u00ebnyr\u00eb \u00ebsht\u00eb ulur konsumimi i memories gjat\u00eb trajtimit t\u00eb k\u00ebrkesave afatgjata n\u00eb konfigurimet ku p\u00ebrdoren drejtorit\u00eb \u00abgzip\u00bb, \u00abgunzip\u00bb, \u00abssi\u00bb, \u00absub_filter\u00bb ose \u00abgrpc_pass\u00bb.\n
Gabimet n\u00eb realizimin e HTTP\/3 jan\u00eb korrigjuar. <\/ul>\n
Gjithashtu, merret parasysh publikimi i deg\u00ebs s\u00eb re kryesore FreeNginx 1.27.0, nj\u00eb fork i Nginx, i zhvilluar nga Maksim Dunin, nj\u00eb nga zhvilluesit kryesor\u00eb t\u00eb Nginx. FreeNginx pozicionohet si nj\u00eb projekt jo fitimprur\u00ebs, q\u00eb siguron zhvillimin e kodit burimor t\u00eb Nginx pa nd\u00ebrhyrje korporative. N\u00eb versionin e ri \u00ebsht\u00eb p\u00ebrmir\u00ebsuar trajtimi i gabimeve gjat\u00eb leximit t\u00eb trupit t\u00eb k\u00ebrkes\u00ebs, \u00ebsht\u00eb optimizuar nd\u00ebrtimi n\u00eb NetBSD 10.0 dhe \u00ebsht\u00eb p\u00ebrmir\u00ebsuar regjistrimi i skedar\u00ebve PID (n\u00eb drejtori \u00ebsht\u00eb shtuar parametri \u00aboff\u00bb). \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"