linux/meta-openembedded.git/meta-webserver/recipes-httpd/nginx, branch kirkstone-next

nginx: fix CVE-2025-23419

2025-03-06T14:48:58+00:00

CVE-2025-23419: When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is performing client certificate authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Refer: https://nvd.nist.gov/vuln/detail/CVE-2025-23419 This partially cherry picked from commit 13935cf9fdc3c8d8278c70716417d3b71c36140e, the original patch had 2 parts. One fixed problem in `http/ngx_http_request` module and the second fixed problem in `stream/ngx_stream_ssl_module` module. The fix for `stream/ngx_stream_ssl_module can't be aplied because, the 'stream virtual servers' funcionality was added later in this commit: https://github.com/nginx/nginx/commit/d21675228a0ba8d4331e05c60660228a5d3326de. Therefore only `http/ngx_http_request` part was backported. Signed-off-by: Changqing Li Signed-off-by: Armin Kuster

nginx: Backport fix for CVE-2024-7347

2024-08-25T22:12:00+00:00

Upstream-Status: Backport [https://github.com/nginx/nginx/commit/88955b1044ef38315b77ad1a509d63631a790a0f & https://github.com/nginx/nginx/commit/7362d01658b61184108c21278443910da68f93b4] Signed-off-by: Ashish Sharma Signed-off-by: Armin Kuster

nginx-1.20.1: Drop reference to removed patch

2024-07-18T00:09:11+00:00

Follow-up to commits 38a07ce and 8e297cd. Also remove remaining reference to removed patch in nginx 1.20.1. Signed-off-by: Jasper Orschulko Signed-off-by: Alexandre Belloni Signed-off-by: Armin Kuster

nginx-1.21.1: Drop reference to removed patch

2024-06-27T15:20:56+00:00

Align to commit 8e297cdc841c6cad34097f00a6903ba25edfc153 ("nginx: Remove obsolete patch") by removing reference to removed patch file. By doing so we mitigate the following BitBake complaint: WARNING: .../meta-openembedded/meta-webserver/recipes-httpd/nginx/nginx_1.21.1.bb: Unable to get checksum for nginx SRC_URI entry 0001-HTTP-2-per-iteration-stream-handling-limit.patch: file could not be found Signed-off-by: Niko Mauno Signed-off-by: Armin Kuster

nginx: Remove obsolete patch

2024-06-02T19:16:32+00:00

With the inclusion of commit 85102dd2dff41945997b983f7c2bfc954dd3bc47 the same patch was introduced again, thus this copy can be deleted (which accidently was never used, since I originally forgot to add it to the SRC_URI, whoops). Signed-off-by: Jasper Orschulko Signed-off-by: Armin Kuster

nginx: fix CVE-2023-44487

2024-05-26T19:21:47+00:00

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. References: https://nvd.nist.gov/vuln/detail/CVE-2023-44487 Signed-off-by: Meenali Gupta Signed-off-by: Armin Kuster

nginx: Mitigate HTTP/2 Stream Resets Flood impact

2023-12-13T18:35:51+00:00

Reduces the impact of HTTP/2 Stream Reset flooding in the nginx product (CVE-2023-44487). See: https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/ This patch only reduces the impact and does not completely mitigate the CVE in question, the latter being due to a design flaw in the HTTP/2 protocol itself. For transparancy reasons I therefore opted to not mark the CVE as resolved, so that integrators can decide for themselves, wheither to enable HTTP/2 support or allow HTTP/1.1 connections only. Signed-off-by: Jasper Orschulko Signed-off-by: Armin Kuster

nginx: upgrade to 1.24.0 release

2023-11-18T15:03:19+00:00

According to http://nginx.org/en/CHANGES nginx supports the openssl 3.x component only from version 1.21.2. In Kirstone openssl 3.x is included but all provided versions of nginx are older, so there is currently an incompatibility. With this patch this incompatibility get removed. Signed-off-by: Michael Haener Signed-off-by: Armin Kuster

nginx: add configure option

2023-10-17T12:53:00+00:00

Support --with-http_xslt_module configure option via a PACKAGECONFIG option. The option is not added to the defaults. Signed-off-by: Joe Slater Signed-off-by: Khem Raj (cherry picked from commit e0ac8eec48ddddc93751cfcdef2557998bfe91c8) Signed-off-by: Armin Kuster

webserver: nginx: Add stream

2023-07-04T14:20:46+00:00

Signed-off-by: Luke Schaefer Add stream support to nginx PACKAGECONFIG Signed-off-by: Armin Kuster