From a0081aa1f8c332d5fb6dbb19de9e46cb39be4931 Mon Sep 17 00:00:00 2001 From: Waldemar Brodkorb Date: Fri, 16 Jan 2026 17:43:34 +0100 Subject: [PATCH] package/nginx: security bump to 1.28.1 See here for changes: https://nginx.org/en/CHANGES-1.28 Following security related issues are fixed: *) Security: processing of a specially crafted login/password when using the "none" authentication method in the ngx_mail_smtp_module might cause worker process memory disclosure to the authentication server (CVE-2025-53859). *) Security: insufficient check in virtual servers handling with TLSv1.3 SNI allowed to reuse SSL sessions in a different virtual server, to bypass client SSL certificates verification (CVE-2025-23419). *) Security: processing of a specially crafted mp4 file by the ngx_http_mp4_module might cause a worker process crash (CVE-2024-7347). Thanks to Nils Bars. *) Security: when using HTTP/3, processing of a specially crafted QUIC session might cause a worker process crash, worker process memory disclosure on systems with MTU larger than 4096 bytes, or might have potential other impact (CVE-2024-32760, CVE-2024-31079, CVE-2024-35200, CVE-2024-34161). Thanks to Nils Bars of CISPA. Update patch 0007, which does not apply cleanly. License file was changed, year was bumped to 2025. Signed-off-by: Waldemar Brodkorb Signed-off-by: Peter Korsgaard --- ...nix-ngx_linux_config.h-only-include-dlfcn.h-.patch | 11 ++++------- package/nginx/nginx.hash | 4 ++-- package/nginx/nginx.mk | 2 +- 3 files changed, 7 insertions(+), 10 deletions(-) diff --git a/package/nginx/0007-src-os-unix-ngx_linux_config.h-only-include-dlfcn.h-.patch b/package/nginx/0007-src-os-unix-ngx_linux_config.h-only-include-dlfcn.h-.patch index c10fcd11c9..4656634bd3 100644 --- a/package/nginx/0007-src-os-unix-ngx_linux_config.h-only-include-dlfcn.h-.patch +++ b/package/nginx/0007-src-os-unix-ngx_linux_config.h-only-include-dlfcn.h-.patch @@ -10,11 +10,11 @@ Signed-off-by: Martin Bark 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/os/unix/ngx_linux_config.h b/src/os/unix/ngx_linux_config.h -index 2f6129d..4244086 100644 +index d99358c93..612935524 100644 --- a/src/os/unix/ngx_linux_config.h +++ b/src/os/unix/ngx_linux_config.h -@@ -55,10 +55,12 @@ - #include +@@ -54,10 +54,12 @@ + #include #include /* uname() */ -#include @@ -27,7 +27,4 @@ index 2f6129d..4244086 100644 +#endif - #if (NGX_HAVE_POSIX_SEM) --- -2.8.2 - + #if (NGX_HAVE_CRYPT_H) diff --git a/package/nginx/nginx.hash b/package/nginx/nginx.hash index 77220665f3..7b79036b20 100644 --- a/package/nginx/nginx.hash +++ b/package/nginx/nginx.hash @@ -1,4 +1,4 @@ # Locally calculated after checking pgp signature -sha256 69ee2b237744036e61d24b836668aad3040dda461fe6f570f1787eab570c75aa nginx-1.26.3.tar.gz +sha256 40e7a0916d121e8905ef50f2a738b675599e42b2224a582dd938603fed15788e nginx-1.28.1.tar.gz # License files, locally calculated -sha256 f19c4caea60247490199c5a6d0134281e3fb20b3d7577e6873c628597f5381d9 LICENSE +sha256 77c01620abf36ed747b7eca4bd271e49023fe3a8e2b3525bcf4b09c8e3aa28e4 LICENSE diff --git a/package/nginx/nginx.mk b/package/nginx/nginx.mk index 6ca1ac2075..41490caee2 100644 --- a/package/nginx/nginx.mk +++ b/package/nginx/nginx.mk @@ -4,7 +4,7 @@ # ################################################################################ -NGINX_VERSION = 1.26.3 +NGINX_VERSION = 1.28.1 NGINX_SITE = https://nginx.org/download NGINX_LICENSE = BSD-2-Clause NGINX_LICENSE_FILES = LICENSE