diff --git a/backport-CVE-2023-44487.patch b/backport-CVE-2023-44487.patch deleted file mode 100644 index 4731cee68788c350583150befa44cc333f460d0e..0000000000000000000000000000000000000000 --- a/backport-CVE-2023-44487.patch +++ /dev/null @@ -1,76 +0,0 @@ -From 6ceef192e7af1c507826ac38a2d43f08bf265fb9 Mon Sep 17 00:00:00 2001 -From: Maxim Dounin -Date: Tue, 10 Oct 2023 15:13:39 +0300 -Subject: [PATCH] HTTP/2: per-iteration stream handling limit. - -To ensure that attempts to flood servers with many streams are detected -early, a limit of no more than 2 * max_concurrent_streams new streams per one -event loop iteration was introduced. This limit is applied even if -max_concurrent_streams is not yet reached - for example, if corresponding -streams are handled synchronously or reset. - -Further, refused streams are now limited to maximum of max_concurrent_streams -and 100, similarly to priority_limit initial value, providing some tolerance -to clients trying to open several streams at the connection start, yet -low tolerance to flooding attempts. - -Conflict: context adapt -Reference: https://github.com/nginx/nginx/commit/6ceef192e7af1c507826ac38a2d43f08bf265fb9 ---- - src/http/v2/ngx_http_v2.c | 15 +++++++++++++++ - src/http/v2/ngx_http_v2.h | 2 ++ - 2 files changed, 17 insertions(+) - -diff --git a/src/http/v2/ngx_http_v2.c b/src/http/v2/ngx_http_v2.c -index 7c05ff1e78..410a8be24e 100644 ---- a/src/http/v2/ngx_http_v2.c -+++ b/src/http/v2/ngx_http_v2.c -@@ -347,6 +347,7 @@ ngx_http_v2_read_handler(ngx_event_t *rev) - ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0, "http2 read handler"); - - h2c->blocked = 1; -+ h2c->new_streams = 0; - - if (c->close) { - c->close = 0; -@@ -1284,6 +1285,14 @@ ngx_http_v2_state_headers(ngx_http_v2_connection_t *h2c, u_char *pos, - goto rst_stream; - } - -+ if (h2c->new_streams++ >= 2 * h2scf->concurrent_streams) { -+ ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0, -+ "client sent too many streams at once"); -+ -+ status = NGX_HTTP_V2_REFUSED_STREAM; -+ goto rst_stream; -+ } -+ - if (!h2c->settings_ack - && !(h2c->state.flags & NGX_HTTP_V2_END_STREAM_FLAG) - && h2scf->preread_size < NGX_HTTP_V2_DEFAULT_WINDOW) -@@ -1349,6 +1358,12 @@ ngx_http_v2_state_headers(ngx_http_v2_connection_t *h2c, u_char *pos, - - rst_stream: - -+ if (h2c->refused_streams++ > ngx_max(h2scf->concurrent_streams, 100)) { -+ ngx_log_error(NGX_LOG_INFO, h2c->connection->log, 0, -+ "client sent too many refused streams"); -+ return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_NO_ERROR); -+ } -+ - if (ngx_http_v2_send_rst_stream(h2c, h2c->state.sid, status) != NGX_OK) { - return ngx_http_v2_connection_error(h2c, NGX_HTTP_V2_INTERNAL_ERROR); - } -diff --git a/src/http/v2/ngx_http_v2.h b/src/http/v2/ngx_http_v2.h -index cb9014ccfb..6751b3026d 100644 ---- a/src/http/v2/ngx_http_v2.h -+++ b/src/http/v2/ngx_http_v2.h -@@ -131,6 +131,8 @@ struct ngx_http_v2_connection_s { - ngx_uint_t processing; - ngx_uint_t frames; - ngx_uint_t idle; -+ ngx_uint_t new_streams; -+ ngx_uint_t refused_streams; - ngx_uint_t priority_limit; - - ngx_uint_t pushing; diff --git a/backport-CVE-2024-7347.patch b/backport-CVE-2024-7347.patch deleted file mode 100644 index d4e44c88b0658eb5d4fef32abc49b34ab7ed148c..0000000000000000000000000000000000000000 --- a/backport-CVE-2024-7347.patch +++ /dev/null @@ -1,43 +0,0 @@ -diff --git a/src/http/modules/ngx_http_mp4_module.c b/src/http/modules/ngx_http_mp4_module.c ---- a/src/http/modules/ngx_http_mp4_module.c -+++ b/src/http/modules/ngx_http_mp4_module.c -@@ -3099,7 +3099,8 @@ static ngx_int_t - ngx_http_mp4_crop_stsc_data(ngx_http_mp4_file_t *mp4, - ngx_http_mp4_trak_t *trak, ngx_uint_t start) - { -- uint32_t start_sample, chunk, samples, id, next_chunk, n, -+ uint64_t n; -+ uint32_t start_sample, chunk, samples, id, next_chunk, - prev_samples; - ngx_buf_t *data, *buf; - ngx_uint_t entries, target_chunk, chunk_samples; -@@ -3155,12 +3156,19 @@ ngx_http_mp4_crop_stsc_data(ngx_http_mp4 - - next_chunk = ngx_mp4_get_32value(entry->chunk); - -+ if (next_chunk < chunk) { -+ ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, -+ "unordered mp4 stsc chunks in \"%s\"", -+ mp4->file.name.data); -+ return NGX_ERROR; -+ } -+ - ngx_log_debug5(NGX_LOG_DEBUG_HTTP, mp4->file.log, 0, - "sample:%uD, chunk:%uD, chunks:%uD, " - "samples:%uD, id:%uD", - start_sample, chunk, next_chunk - chunk, samples, id); - -- n = (next_chunk - chunk) * samples; -+ n = (uint64_t) (next_chunk - chunk) * samples; - - if (start_sample < n) { - goto found; -@@ -3182,7 +3190,7 @@ ngx_http_mp4_crop_stsc_data(ngx_http_mp4 - "sample:%uD, chunk:%uD, chunks:%uD, samples:%uD", - start_sample, chunk, next_chunk - chunk, samples); - -- n = (next_chunk - chunk) * samples; -+ n = (uint64_t) (next_chunk - chunk) * samples; - - if (start_sample > n) { - ngx_log_error(NGX_LOG_ERR, mp4->file.log, 0, diff --git a/nginx-1.24.0.tar.gz b/nginx-1.24.0.tar.gz deleted file mode 100644 index 1aeeaf85881597dec6537e927c8c6819385c779c..0000000000000000000000000000000000000000 Binary files a/nginx-1.24.0.tar.gz and /dev/null differ diff --git a/nginx-1.26.3.tar.gz b/nginx-1.26.3.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..af1077dd4c68eae817ba699bf53a952f954489ff Binary files /dev/null and b/nginx-1.26.3.tar.gz differ diff --git a/nginx.spec b/nginx.spec index 68b2d535cb0136180c72d9f74b03797b219b11cc..6e380ee317dd7156ebef7900fc0a6f03e5ea3200 100644 --- a/nginx.spec +++ b/nginx.spec @@ -16,10 +16,10 @@ Name: nginx Epoch: 1 -Version: 1.24.0 -Release: 2 +Version: 1.26.3 +Release: 1 Summary: A HTTP server, reverse proxy and mail proxy server -License: BSD +License: BSD-2-Clause URL: http://nginx.org/ Source0: https://nginx.org/download/nginx-%{version}.tar.gz @@ -39,9 +39,6 @@ Source210: UPGRADE-NOTES-1.6-to-1.10 Patch0: nginx-auto-cc-gcc.patch Patch1: nginx-1.12.1-logs-perm.patch Patch2: nginx-fix-pidfile.patch -Patch3: backport-CVE-2023-44487.patch -# https://nginx.org/download/patch.2024.mp4.txt -Patch4: backport-CVE-2024-7347.patch BuildRequires: gcc openssl-devel pcre2-devel zlib-devel systemd gperftools-devel Requires: nginx-filesystem = %{epoch}:%{version}-%{release} openssl @@ -389,6 +386,9 @@ fi %{_mandir}/man8/nginx.8* %changelog +* Thu Feb 06 2025 gaihuiying - 1:1.26.3-1 +- update nginx to 1.26.3 + * Thu Aug 15 2024 Funda Wang - 1:1.24.0-2 - fix CVE-2024-7347