wrapper/nginx-sid
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

release nginx 1.22.1-9+deb12u1, upload to bookworm pu

Browse source
This commit is contained in:
Jan Mojžíš 2025-03-06 07:10:51 +01:00
parent 3fdf9b9553
commit b1b8bf71fb
No known key found for this signature in database
GPG key ID: 45DA517496939FF9
3 changed files with 77 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
debian/changelog vendored
View file

@ -1,3 +1,9 @@
nginx (1.22.1-9+deb12u1) bookworm; urgency=medium
* d/p/CVE-2025-23419.patch add, backport CVE-2025-23419 fix.
-- Jan Mojžíš <janmojzis@debian.org> Mon, 17 Feb 2025 20:40:29 +0100
nginx (1.22.1-9) unstable; urgency=medium
* d/control: nginx-common Breaks+Replaces: nginx (<< 1.22.1-8)

70
debian/patches/CVE-2025-23419.patch vendored Normal file
View file

@ -0,0 +1,70 @@
From: =?utf-8?b?SmFuIE1vasW+w63FoQ==?= <jan.mojzis@gmail.com>
Date: Mon, 17 Feb 2025 20:39:22 +0100
Subject: CVE-2025-23419
Origin: https://github.com/nginx/nginx/commit/13935cf9fdc3c8d8278c70716417d3b71c36140e
SNI: added restriction for TLSv1.3 cross-SNI session resumption.
In OpenSSL, session resumption always happens in the default SSL context,
prior to invoking the SNI callback. Further, unlike in TLSv1.2 and older
protocols, SSL_get_servername() returns values received in the resumption
handshake, which may be different from the value in the initial handshake.
Notably, this makes the restriction added in b720f65 insufficient for
sessions resumed with different SNI server name.
Considering the example from b720f65, previously, a client was able to
request example.org by presenting a certificate for example.org, then to
resume and request example.com.
The fix is to reject handshakes resumed with a different server name, if
verification of client certificates is enabled in a corresponding server
configuration.
---
src/http/ngx_http_request.c | 27 +++++++++++++++++++++++++--
1 file changed, 25 insertions(+), 2 deletions(-)
diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c
index a999ff5..4708719 100644
--- a/src/http/ngx_http_request.c
+++ b/src/http/ngx_http_request.c
@@ -909,6 +909,31 @@ ngx_http_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg)
goto done;
}
+ sscf = ngx_http_get_module_srv_conf(cscf->ctx, ngx_http_ssl_module);
+
+#if (defined TLS1_3_VERSION \
+ && !defined LIBRESSL_VERSION_NUMBER && !defined OPENSSL_IS_BORINGSSL)
+
+ /*
+ * SSL_SESSION_get0_hostname() is only available in OpenSSL 1.1.1+,
+ * but servername being negotiated in every TLSv1.3 handshake
+ * is only returned in OpenSSL 1.1.1+ as well
+ */
+
+ if (sscf->verify) {
+ const char *hostname;
+
+ hostname = SSL_SESSION_get0_hostname(SSL_get0_session(ssl_conn));
+
+ if (hostname != NULL && ngx_strcmp(hostname, servername) != 0) {
+ c->ssl->handshake_rejected = 1;
+ *ad = SSL_AD_ACCESS_DENIED;
+ return SSL_TLSEXT_ERR_ALERT_FATAL;
+ }
+ }
+
+#endif
+
hc->ssl_servername = ngx_palloc(c->pool, sizeof(ngx_str_t));
if (hc->ssl_servername == NULL) {
goto error;
@@ -922,8 +947,6 @@ ngx_http_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg)
ngx_set_connection_log(c, clcf->error_log);
- sscf = ngx_http_get_module_srv_conf(hc->conf_ctx, ngx_http_ssl_module);
-
c->ssl->buffer_size = sscf->buffer_size;
if (sscf->ssl.ctx) {

1
debian/patches/series vendored
View file

@ -3,3 +3,4 @@ nginx-fix-pidfile.patch
nginx-ssl_cert_cb_yield.patch
bug-1024605.patch
bug-973861.patch
CVE-2025-23419.patch