mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-30 14:01:57 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/nginx: security bump to 1.28.1

Browse Source 
See here for changes:
https://nginx.org/en/CHANGES-1.28

Following security related issues are fixed:
    *) Security: processing of a specially crafted login/password when using
       the "none" authentication method in the ngx_mail_smtp_module might
       cause worker process memory disclosure to the authentication server
       (CVE-2025-53859).
    *) Security: insufficient check in virtual servers handling with TLSv1.3
       SNI allowed to reuse SSL sessions in a different virtual server, to
       bypass client SSL certificates verification (CVE-2025-23419).
    *) Security: processing of a specially crafted mp4 file by the
       ngx_http_mp4_module might cause a worker process crash
       (CVE-2024-7347).
       Thanks to Nils Bars.
    *) Security: when using HTTP/3, processing of a specially crafted QUIC
       session might cause a worker process crash, worker process memory
       disclosure on systems with MTU larger than 4096 bytes, or might have
       potential other impact (CVE-2024-32760, CVE-2024-31079,
       CVE-2024-35200, CVE-2024-34161).
       Thanks to Nils Bars of CISPA.

Update patch 0007, which does not apply cleanly.
License file was changed, year was bumped to 2025.

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a0081aa1f8)
[thomas: remove previously Cherry picked commit]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Waldemar Brodkorb
2026-01-16 17:43:34 +01:00
committed by Thomas Perale
parent 092e63a37b
commit c3d3537374
4 changed files with 7 additions and 143 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
package/nginx/0007-src-os-unix-ngx_linux_config.h-only-include-dlfcn.h-.patch
View File

@@ -10,11 +10,11 @@ Signed-off-by: Martin Bark <martin@barkynet.com>
1 file changed, 4 insertions(+), 2 deletions(-) 1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/src/os/unix/ngx_linux_config.h b/src/os/unix/ngx_linux_config.h diff --git a/src/os/unix/ngx_linux_config.h b/src/os/unix/ngx_linux_config.h
index 2f6129d..4244086 100644 index d99358c93..612935524 100644
--- a/src/os/unix/ngx_linux_config.h --- a/src/os/unix/ngx_linux_config.h
+++ b/src/os/unix/ngx_linux_config.h +++ b/src/os/unix/ngx_linux_config.h
@@ -55,10 +55,12 @@ @@ -54,10 +54,12 @@
#include <crypt.h> #include <sys/ioctl.h>
#include <sys/utsname.h> /* uname() */ #include <sys/utsname.h> /* uname() */
-#include <dlfcn.h> -#include <dlfcn.h>
@@ -27,7 +27,4 @@ index 2f6129d..4244086 100644
+#endif +#endif
#if (NGX_HAVE_POSIX_SEM) #if (NGX_HAVE_CRYPT_H)
--
2.8.2

130
package/nginx/0010-CVE-2025-53859.patch
View File

@@ -1,130 +0,0 @@
CVE: CVE-2025-53859
Upstream: https://nginx.org/download/patch.2025.smtp.txt
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
diff --git a/src/mail/ngx_mail_handler.c b/src/mail/ngx_mail_handler.c
index 1167df3fb..d3be7f3b3 100644
--- a/src/mail/ngx_mail_handler.c
+++ b/src/mail/ngx_mail_handler.c
@@ -523,7 +523,7 @@ ngx_mail_starttls_only(ngx_mail_session_t *s, ngx_connection_t *c)
ngx_int_t
ngx_mail_auth_plain(ngx_mail_session_t *s, ngx_connection_t *c, ngx_uint_t n)
{
- u_char *p, *last;
+ u_char *p, *pos, *last;
ngx_str_t *arg, plain;
arg = s->args.elts;
@@ -555,7 +555,7 @@ ngx_mail_auth_plain(ngx_mail_session_t *s, ngx_connection_t *c, ngx_uint_t n)
return NGX_MAIL_PARSE_INVALID_COMMAND;
}
- s->login.data = p;
+ pos = p;
while (p < last && *p) { p++; }
@@ -565,7 +565,8 @@ ngx_mail_auth_plain(ngx_mail_session_t *s, ngx_connection_t *c, ngx_uint_t n)
return NGX_MAIL_PARSE_INVALID_COMMAND;
}
- s->login.len = p++ - s->login.data;
+ s->login.len = p++ - pos;
+ s->login.data = pos;
s->passwd.len = last - p;
s->passwd.data = p;
@@ -583,24 +584,26 @@ ngx_int_t
ngx_mail_auth_login_username(ngx_mail_session_t *s, ngx_connection_t *c,
ngx_uint_t n)
{
- ngx_str_t *arg;
+ ngx_str_t *arg, login;
arg = s->args.elts;
ngx_log_debug1(NGX_LOG_DEBUG_MAIL, c->log, 0,
"mail auth login username: \"%V\"", &arg[n]);
- s->login.data = ngx_pnalloc(c->pool, ngx_base64_decoded_length(arg[n].len));
- if (s->login.data == NULL) {
+ login.data = ngx_pnalloc(c->pool, ngx_base64_decoded_length(arg[n].len));
+ if (login.data == NULL) {
return NGX_ERROR;
}
- if (ngx_decode_base64(&s->login, &arg[n]) != NGX_OK) {
+ if (ngx_decode_base64(&login, &arg[n]) != NGX_OK) {
ngx_log_error(NGX_LOG_INFO, c->log, 0,
"client sent invalid base64 encoding in AUTH LOGIN command");
return NGX_MAIL_PARSE_INVALID_COMMAND;
}
+ s->login = login;
+
ngx_log_debug1(NGX_LOG_DEBUG_MAIL, c->log, 0,
"mail auth login username: \"%V\"", &s->login);
@@ -611,7 +614,7 @@ ngx_mail_auth_login_username(ngx_mail_session_t *s, ngx_connection_t *c,
ngx_int_t
ngx_mail_auth_login_password(ngx_mail_session_t *s, ngx_connection_t *c)
{
- ngx_str_t *arg;
+ ngx_str_t *arg, passwd;
arg = s->args.elts;
@@ -620,18 +623,19 @@ ngx_mail_auth_login_password(ngx_mail_session_t *s, ngx_connection_t *c)
"mail auth login password: \"%V\"", &arg[0]);
#endif
- s->passwd.data = ngx_pnalloc(c->pool,
- ngx_base64_decoded_length(arg[0].len));
- if (s->passwd.data == NULL) {
+ passwd.data = ngx_pnalloc(c->pool, ngx_base64_decoded_length(arg[0].len));
+ if (passwd.data == NULL) {
return NGX_ERROR;
}
- if (ngx_decode_base64(&s->passwd, &arg[0]) != NGX_OK) {
+ if (ngx_decode_base64(&passwd, &arg[0]) != NGX_OK) {
ngx_log_error(NGX_LOG_INFO, c->log, 0,
"client sent invalid base64 encoding in AUTH LOGIN command");
return NGX_MAIL_PARSE_INVALID_COMMAND;
}
+ s->passwd = passwd;
+
#if (NGX_DEBUG_MAIL_PASSWD)
ngx_log_debug1(NGX_LOG_DEBUG_MAIL, c->log, 0,
"mail auth login password: \"%V\"", &s->passwd);
@@ -674,24 +678,26 @@ ngx_int_t
ngx_mail_auth_cram_md5(ngx_mail_session_t *s, ngx_connection_t *c)
{
u_char *p, *last;
- ngx_str_t *arg;
+ ngx_str_t *arg, login;
arg = s->args.elts;
ngx_log_debug1(NGX_LOG_DEBUG_MAIL, c->log, 0,
"mail auth cram-md5: \"%V\"", &arg[0]);
- s->login.data = ngx_pnalloc(c->pool, ngx_base64_decoded_length(arg[0].len));
- if (s->login.data == NULL) {
+ login.data = ngx_pnalloc(c->pool, ngx_base64_decoded_length(arg[0].len));
+ if (login.data == NULL) {
return NGX_ERROR;
}
- if (ngx_decode_base64(&s->login, &arg[0]) != NGX_OK) {
+ if (ngx_decode_base64(&login, &arg[0]) != NGX_OK) {
ngx_log_error(NGX_LOG_INFO, c->log, 0,
"client sent invalid base64 encoding in AUTH CRAM-MD5 command");
return NGX_MAIL_PARSE_INVALID_COMMAND;
}
+ s->login = login;
+
p = s->login.data;
last = p + s->login.len;

4
package/nginx/nginx.hash
View File

@@ -1,4 +1,4 @@
# Locally calculated after checking pgp signature # Locally calculated after checking pgp signature
sha256 69ee2b237744036e61d24b836668aad3040dda461fe6f570f1787eab570c75aa nginx-1.26.3.tar.gz sha256 40e7a0916d121e8905ef50f2a738b675599e42b2224a582dd938603fed15788e nginx-1.28.1.tar.gz
# License files, locally calculated # License files, locally calculated
sha256 f19c4caea60247490199c5a6d0134281e3fb20b3d7577e6873c628597f5381d9 LICENSE sha256 77c01620abf36ed747b7eca4bd271e49023fe3a8e2b3525bcf4b09c8e3aa28e4 LICENSE

5
package/nginx/nginx.mk
View File

@@ -4,7 +4,7 @@
# #
################################################################################ ################################################################################
NGINX_VERSION = 1.26.3 NGINX_VERSION = 1.28.1
NGINX_SITE = https://nginx.org/download NGINX_SITE = https://nginx.org/download
NGINX_LICENSE = BSD-2-Clause NGINX_LICENSE = BSD-2-Clause
NGINX_LICENSE_FILES = LICENSE NGINX_LICENSE_FILES = LICENSE
@@ -19,9 +19,6 @@ NGINX_CONF_OPTS = \
--with-cpp="$(TARGET_CC)" \ --with-cpp="$(TARGET_CC)" \
--with-ld-opt="$(TARGET_LDFLAGS)" --with-ld-opt="$(TARGET_LDFLAGS)"
# 0010-CVE-2025-53859.patch
NGINX_IGNORE_CVES += CVE-2025-53859
# www-data user and group are used for nginx. Because these user and group # www-data user and group are used for nginx. Because these user and group
# are already set by buildroot, it is not necessary to redefine them. # are already set by buildroot, it is not necessary to redefine them.
# See system/skeleton/etc/passwd # See system/skeleton/etc/passwd