ืื ืืืืคึผื ืฆืืืืึทื ืคืื nginx 1.23.2 ืืื ืืืคืจืืื, ืืื ืืืึธืก ืื ืึทื ืืืืืงืืื ื ืคืื ื ืืึท ืคึฟืขืึดืงืืืื ืืืื, ืืื ืืขืืื ื ืืื ืื ืืขืืืื ื ืคืื ืื ืคึผืึทืจืึทืืขื ืืขืฉืืืฆื ืกืืึทืืื ืฆืืืืึทื ืคืื nginx 1.22.1, ืืืึธืก ืืืืื ืื ืงืืืื ืขื ืืขืจืื ืืขื ืฉืืึทืืืช ืฆื ืื ืืืืืึทื ืืืฉืึทื ืคืื ืขืจื ืกื ืขืจืจืึธืจืก ืืื ืืืึทืื ืขืจืึทืืืืืืื.
ืื ื ืืึทืข ืืืขืจืกืืขืก ืขืืืืื ืืจื ืฆืืืื ืืืึทืื ืขืจืึทืืืืืืื (CVE-2022-41741, CVE-2022-41742) ืืื ืื ngx_http_mp4_module ืืึธืืืืข, ืืขื ืืฆื ืฆื ืึธืจืืึทื ืืืืจื ืกืืจืืืื ื ืคืื ืืขืงืขืก ืืื ืื H.264/AAC ืคึฟืึธืจืืึทื. ืื ืืืึทืื ืขืจืึทืืืืืืื ืงืขื ืคืืจื ืฆื ืืืงืึธืจื ืงืึธืจืืคึผืฆืืข ืึธืืขืจ ืืึผืจืื ืจืื ืขื ืืืขื ืคึผืจืึทืกืขืกืื ื ืึท ืกืคึผืขืฉืื ืงืจืึทืคืืขื mp4 ืืขืงืข. ืึท ื ืืืืคืึทื ืืขืจืืึทื ืืืฉืึทื ืคืื ืึท ืึทืจืืขื ืคึผืจืึธืฆืขืก ืืื ืืขืจืืื ื ืืื ืึท ืงืึทื ืกืึทืงืืืึทื ืก, ืึธืืขืจ ืื ืืขืจืข ืืึทื ืึทืคืขืกืืืืฉืึทื ื ืืขื ืขื ื ืืฉื ืืงืกืงืืืืื, ืึทืืึท ืืื ืื ืึธืจืืึทื ืืืึทืฆืืข ืคืื โโืงืึธื ืืืจืืคืืจืื ื ืืืืฃ ืื ืกืขืจืืืขืจ.
ืขืก ืืื ื ืึธืืืืืขืจืื ืึทื ืึท ืขื ืืขื ืืืึทืื ืขืจืึทืืืืืื ืืื ืฉืืื ืคืึทืจืคืขืกืืืงื ืืื ืื ngx_http_mp4_module ืืึธืืืืข ืืื 2012. ืืื ืึทืืืฉืึทื, F5 ืืขืืืืื ืึท ืขื ืืขื ืืืึทืื ืขืจืึทืืืืืื (CVE-2022-41743) ืืื ืื NGINX Plus ืคึผืจืึธืืืงื, ืืืึธืก ืึทืคืขืงืฅ ืื ngx_http_hls_module ืืึธืืืืข, ืืืึธืก ืืื ืฉืืืฆื ืคึฟืึทืจ ืื HLS (Apple HTTP Live Streaming) ืคึผืจืึธืืึธืงืึธื.
ืืื ืึทืืืฉืึทื ืฆื ืืืืืึทื ืืืืื ื ืืืึทืื ืขืจืึทืืืืืืื, ืื ืคืืืืขื ืืข ืขื ืืขืจืื ืืขื ืืขื ืขื ืคืืจืืขืืืืื ืืื nginx 1.23.2:
- ืฆืืืขืืขืื ืฉืืืฆื ืคึฟืึทืจ ืื "$proxy_protocol_tlv_*" ืืืขืจืืึทืืึทืื, ืืืึธืก ืึทื ืืืึทืืื ืื ืืืึทืืืขืก ืคืื ืื TLV (Type-Length-Value) ืคืขืืืขืจ ืืืึธืก ืืขืจืฉืืึทื ืขื ืืื ืื Type-Length-Value PROXY v2 ืคึผืจืึธืืึธืงืึธื.
- ืฆืืืขืฉืืขืื ืึธืืึทืืึทืืืง ืจืึธืืืืืฉืึทื ืคืื ืขื ืงืจืืคึผืฉืึทื ืฉืืืกืืขื ืคึฟืึทืจ TLS ืกืขืกืืข ืืืงืึทืฅ, ืืขื ืืฆื ืืืขื ื ืืฆื ืฉืขืจื ืืึผืจืื ืืื ืื ssl_session_cache ืืืจืขืงืืืื.
- ืื ืืึธืืื ื ืืืจืื ืคึฟืึทืจ ืขืจืจืึธืจืก ืฉืืึทืืืช ืฆื ืคืึทืืฉ ืกืกื ืจืขืงืึธืจื ืืืืคึผืก ืืื ืืึธืืขืจื ืคืื ืงืจืืืืฉ ืฆื ืื ืคืึธืจืืึทืืืื ืืืจืื.
- ืื ืืึธืืื ื ืืืจืื ืคึฟืึทืจ ืึทืจืืืงืืขื ืืืขืื ืื ืื ืึทืืืืืื ืฆื ืึทืืึทืงืืื ืืืงืึธืจื ืคึฟืึทืจ ืึท ื ืืึทืข ืกืขืกืืข ืืื ืืฉืืื ืืืฉื ืคืื ืคืืื ืง ืฆื ืืืึธืจืขื ืขื ืืื ืืื ืืืืืืขื ืฆื ืึทืจืืืกืคืืจื ืืืื ืคึผืึธืืืฆืืข ืคึผืขืจ ืกืขืงืื ืืข.
- ืืืืฃ ืื Windows ืคึผืืึทืืคืึธืจืืข, ืคึฟืึทืจืืึทืืืื ื ืืื OpenSSL 3.0 ืืื ืืขืืจืื ืืขื.
- ืืืคึผืจืืืื ืึธืคึผืฉืคึผืืืืื ื ืคืื PROXY ืคึผืจืึธืืึธืงืึธื ืขืจืจืึธืจืก ืืื ืื ืงืืึธืฅ.
- ืคืึทืจืคืขืกืืืงื ืึทื ืึทืจืืืกืืขืื ืืื ืื ืืืืืึทืื ืกืคึผืขืกืืคืืขื ืืื ืื "ssl_session_timeout" ืืืจืขืงืืืื ืืื ื ืืฉื ืึทืจืืขืื ืืืขื ื ืืฆื TLSv1.3 ืืืืืจื ืืืืฃ OpenSSL ืึธืืขืจ BoringSSL.
ืืงืืจ: opennet.ru