From: Ankur Tyagi <[email protected]>
Made patches for CVE-2024-7347, CVE-2025-23419 specific for v1.24.0 as
these vulnerabilities are fixed in v1.26.3.
Dropped CVE-2025-2341.patch for nginx-1.26.3
Changelog:
https://nginx.org/en/CHANGES-1.26
Signed-off-by: Ankur Tyagi <[email protected]>
---
.../CVE-2024-7347-1.patch | 0
.../CVE-2024-7347-2.patch | 0
.../nginx/nginx-1.26.0/CVE-2025-23419.patch | 119 ------------------
.../CVE-2026-28755.patch | 0
meta-webserver/recipes-httpd/nginx/nginx.inc | 3 -
.../recipes-httpd/nginx/nginx_1.24.0.bb | 3 +
.../{nginx_1.26.0.bb => nginx_1.26.3.bb} | 2 +-
7 files changed, 4 insertions(+), 123 deletions(-)
rename meta-webserver/recipes-httpd/nginx/{files => nginx-1.24.0}/CVE-2024-7347-1.patch (100%)
rename meta-webserver/recipes-httpd/nginx/{files => nginx-1.24.0}/CVE-2024-7347-2.patch (100%)
delete mode 100644 meta-webserver/recipes-httpd/nginx/nginx-1.26.0/CVE-2025-23419.patch
rename meta-webserver/recipes-httpd/nginx/{nginx-1.26.0 => nginx-1.26.3}/CVE-2026-28755.patch (100%)
rename meta-webserver/recipes-httpd/nginx/{nginx_1.26.0.bb => nginx_1.26.3.bb} (77%)
diff --git a/meta-webserver/recipes-httpd/nginx/files/CVE-2024-7347-1.patch b/meta-webserver/recipes-httpd/nginx/nginx-1.24.0/CVE-2024-7347-1.patch
similarity index 100%
rename from meta-webserver/recipes-httpd/nginx/files/CVE-2024-7347-1.patch
rename to meta-webserver/recipes-httpd/nginx/nginx-1.24.0/CVE-2024-7347-1.patch
diff --git a/meta-webserver/recipes-httpd/nginx/files/CVE-2024-7347-2.patch b/meta-webserver/recipes-httpd/nginx/nginx-1.24.0/CVE-2024-7347-2.patch
similarity index 100%
rename from meta-webserver/recipes-httpd/nginx/files/CVE-2024-7347-2.patch
rename to meta-webserver/recipes-httpd/nginx/nginx-1.24.0/CVE-2024-7347-2.patch
diff --git a/meta-webserver/recipes-httpd/nginx/nginx-1.26.0/CVE-2025-23419.patch b/meta-webserver/recipes-httpd/nginx/nginx-1.26.0/CVE-2025-23419.patch
deleted file mode 100644
index d1c5bd9b40..0000000000
--- a/meta-webserver/recipes-httpd/nginx/nginx-1.26.0/CVE-2025-23419.patch
+++ /dev/null
@@ -1,119 +0,0 @@
-From 2de0d3fd114e9d3d6a56bd7298aff8c637063509 Mon Sep 17 00:00:00 2001
-From: Sergey Kandaurov <[email protected]>
-Date: Wed, 22 Jan 2025 18:55:44 +0400
-Subject: [PATCH] SNI: added restriction for TLSv1.3 cross-SNI session
- resumption.
-
-In OpenSSL, session resumption always happens in the default SSL context,
-prior to invoking the SNI callback. Further, unlike in TLSv1.2 and older
-protocols, SSL_get_servername() returns values received in the resumption
-handshake, which may be different from the value in the initial handshake.
-Notably, this makes the restriction added in b720f650b insufficient for
-sessions resumed with different SNI server name.
-
-Considering the example from b720f650b, previously, a client was able to
-request example.org by presenting a certificate for example.org, then to
-resume and request example.com.
-
-The fix is to reject handshakes resumed with a different server name, if
-verification of client certificates is enabled in a corresponding server
-configuration.
-
-CVE: CVE-2025-23419
-Upstream-Status: Backport [https://github.com/nginx/nginx/commit/13935cf9fdc3c8d8278c70716417d3b71c36140e]
-Signed-off-by: Colin Pinnell McAllister <[email protected]>
----
- src/http/ngx_http_request.c | 27 +++++++++++++++++++++++++--
- src/stream/ngx_stream_ssl_module.c | 27 +++++++++++++++++++++++++--
- 2 files changed, 50 insertions(+), 4 deletions(-)
-
-diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c
-index 3cca57cf5..9593b7fb5 100644
---- a/src/http/ngx_http_request.c
-+++ b/src/http/ngx_http_request.c
-@@ -932,6 +932,31 @@ ngx_http_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg)
- goto done;
- }
-
-+ sscf = ngx_http_get_module_srv_conf(cscf->ctx, ngx_http_ssl_module);
-+
-+#if (defined TLS1_3_VERSION \
-+ && !defined LIBRESSL_VERSION_NUMBER && !defined OPENSSL_IS_BORINGSSL)
-+
-+ /*
-+ * SSL_SESSION_get0_hostname() is only available in OpenSSL 1.1.1+,
-+ * but servername being negotiated in every TLSv1.3 handshake
-+ * is only returned in OpenSSL 1.1.1+ as well
-+ */
-+
-+ if (sscf->verify) {
-+ const char *hostname;
-+
-+ hostname = SSL_SESSION_get0_hostname(SSL_get0_session(ssl_conn));
-+
-+ if (hostname != NULL && ngx_strcmp(hostname, servername) != 0) {
-+ c->ssl->handshake_rejected = 1;
-+ *ad = SSL_AD_ACCESS_DENIED;
-+ return SSL_TLSEXT_ERR_ALERT_FATAL;
-+ }
-+ }
-+
-+#endif
-+
- hc->ssl_servername = ngx_palloc(c->pool, sizeof(ngx_str_t));
- if (hc->ssl_servername == NULL) {
- goto error;
-@@ -945,8 +970,6 @@ ngx_http_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg)
-
- ngx_set_connection_log(c, clcf->error_log);
-
-- sscf = ngx_http_get_module_srv_conf(hc->conf_ctx, ngx_http_ssl_module);
--
- c->ssl->buffer_size = sscf->buffer_size;
-
- if (sscf->ssl.ctx) {
-diff --git a/src/stream/ngx_stream_ssl_module.c b/src/stream/ngx_stream_ssl_module.c
-index ba444776a..6dee106de 100644
---- a/src/stream/ngx_stream_ssl_module.c
-+++ b/src/stream/ngx_stream_ssl_module.c
-@@ -521,12 +521,35 @@ ngx_stream_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg)
- goto done;
- }
-
-+ sscf = ngx_stream_get_module_srv_conf(cscf->ctx, ngx_stream_ssl_module);
-+
-+#if (defined TLS1_3_VERSION \
-+ && !defined LIBRESSL_VERSION_NUMBER && !defined OPENSSL_IS_BORINGSSL)
-+
-+ /*
-+ * SSL_SESSION_get0_hostname() is only available in OpenSSL 1.1.1+,
-+ * but servername being negotiated in every TLSv1.3 handshake
-+ * is only returned in OpenSSL 1.1.1+ as well
-+ */
-+
-+ if (sscf->verify) {
-+ const char *hostname;
-+
-+ hostname = SSL_SESSION_get0_hostname(SSL_get0_session(ssl_conn));
-+
-+ if (hostname != NULL && ngx_strcmp(hostname, servername) != 0) {
-+ c->ssl->handshake_rejected = 1;
-+ *ad = SSL_AD_ACCESS_DENIED;
-+ return SSL_TLSEXT_ERR_ALERT_FATAL;
-+ }
-+ }
-+
-+#endif
-+
- s->srv_conf = cscf->ctx->srv_conf;
-
- ngx_set_connection_log(c, cscf->error_log);
-
-- sscf = ngx_stream_get_module_srv_conf(s, ngx_stream_ssl_module);
--
- if (sscf->ssl.ctx) {
- if (SSL_set_SSL_CTX(ssl_conn, sscf->ssl.ctx) == NULL) {
- goto error;
---
-2.52.0
-
diff --git a/meta-webserver/recipes-httpd/nginx/nginx-1.26.0/CVE-2026-28755.patch b/meta-webserver/recipes-httpd/nginx/nginx-1.26.3/CVE-2026-28755.patch
similarity index 100%
rename from meta-webserver/recipes-httpd/nginx/nginx-1.26.0/CVE-2026-28755.patch
rename to meta-webserver/recipes-httpd/nginx/nginx-1.26.3/CVE-2026-28755.patch
diff --git a/meta-webserver/recipes-httpd/nginx/nginx.inc b/meta-webserver/recipes-httpd/nginx/nginx.inc
index e392ed107c..401a207103 100644
--- a/meta-webserver/recipes-httpd/nginx/nginx.inc
+++ b/meta-webserver/recipes-httpd/nginx/nginx.inc
@@ -23,10 +23,7 @@ SRC_URI = " \
file://nginx.service \
file://nginx-fix-pidfile.patch \
file://0001-configure-libxslt-conf.patch \
- file://CVE-2024-7347-1.patch \
- file://CVE-2024-7347-2.patch \
file://CVE-2025-53859.patch \
- file://CVE-2025-23419.patch \
file://CVE-2026-1642.patch \
file://CVE-2026-27784.patch \
"
diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.24.0.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.24.0.bb
index f28a00df5b..b5707d83eb 100644
--- a/meta-webserver/recipes-httpd/nginx/nginx_1.24.0.bb
+++ b/meta-webserver/recipes-httpd/nginx/nginx_1.24.0.bb
@@ -3,6 +3,9 @@ require nginx.inc
LIC_FILES_CHKSUM = "file://LICENSE;md5=175abb631c799f54573dc481454c8632"
SRC_URI:append = " \
+ file://CVE-2024-7347-1.patch \
+ file://CVE-2024-7347-2.patch \
+ file://CVE-2025-23419.patch \
file://CVE-2023-44487.patch \
file://CVE-2026-28755.patch \
file://CVE-2026-27651.patch \
diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.26.0.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.26.3.bb
similarity index 77%
rename from meta-webserver/recipes-httpd/nginx/nginx_1.26.0.bb
rename to meta-webserver/recipes-httpd/nginx/nginx_1.26.3.bb
index 75e05fac6f..658b1c0fce 100644
--- a/meta-webserver/recipes-httpd/nginx/nginx_1.26.0.bb
+++ b/meta-webserver/recipes-httpd/nginx/nginx_1.26.3.bb
@@ -8,5 +8,5 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=a6547d7e5628787ee2a9c5a3480eb628"
SRC_URI:append = " file://CVE-2026-28755.patch"
-SRC_URI[sha256sum] = "d2e6c8439d6c6db5015d8eaab2470ab52aef85a7bf363182879977e084370497"
+SRC_URI[sha256sum] = "69ee2b237744036e61d24b836668aad3040dda461fe6f570f1787eab570c75aa"
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.