diff --git a/package/nginx/0007-src-os-unix-ngx_linux_config.h-only-include-dlfcn.h-.patch b/package/nginx/0007-src-os-unix-ngx_linux_config.h-only-include-dlfcn.h-.patch index c10fcd11c9..4656634bd3 100644 --- a/package/nginx/0007-src-os-unix-ngx_linux_config.h-only-include-dlfcn.h-.patch +++ b/package/nginx/0007-src-os-unix-ngx_linux_config.h-only-include-dlfcn.h-.patch @@ -10,11 +10,11 @@ Signed-off-by: Martin Bark 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/os/unix/ngx_linux_config.h b/src/os/unix/ngx_linux_config.h -index 2f6129d..4244086 100644 +index d99358c93..612935524 100644 --- a/src/os/unix/ngx_linux_config.h +++ b/src/os/unix/ngx_linux_config.h -@@ -55,10 +55,12 @@ - #include +@@ -54,10 +54,12 @@ + #include #include /* uname() */ -#include @@ -27,7 +27,4 @@ index 2f6129d..4244086 100644 +#endif - #if (NGX_HAVE_POSIX_SEM) --- -2.8.2 - + #if (NGX_HAVE_CRYPT_H) diff --git a/package/nginx/0010-CVE-2025-53859.patch b/package/nginx/0010-CVE-2025-53859.patch deleted file mode 100644 index 34befebd8a..0000000000 --- a/package/nginx/0010-CVE-2025-53859.patch +++ /dev/null @@ -1,130 +0,0 @@ -CVE: CVE-2025-53859 -Upstream: https://nginx.org/download/patch.2025.smtp.txt -Signed-off-by: Thomas Perale - -diff --git a/src/mail/ngx_mail_handler.c b/src/mail/ngx_mail_handler.c -index 1167df3fb..d3be7f3b3 100644 ---- a/src/mail/ngx_mail_handler.c -+++ b/src/mail/ngx_mail_handler.c -@@ -523,7 +523,7 @@ ngx_mail_starttls_only(ngx_mail_session_t *s, ngx_connection_t *c) - ngx_int_t - ngx_mail_auth_plain(ngx_mail_session_t *s, ngx_connection_t *c, ngx_uint_t n) - { -- u_char *p, *last; -+ u_char *p, *pos, *last; - ngx_str_t *arg, plain; - - arg = s->args.elts; -@@ -555,7 +555,7 @@ ngx_mail_auth_plain(ngx_mail_session_t *s, ngx_connection_t *c, ngx_uint_t n) - return NGX_MAIL_PARSE_INVALID_COMMAND; - } - -- s->login.data = p; -+ pos = p; - - while (p < last && *p) { p++; } - -@@ -565,7 +565,8 @@ ngx_mail_auth_plain(ngx_mail_session_t *s, ngx_connection_t *c, ngx_uint_t n) - return NGX_MAIL_PARSE_INVALID_COMMAND; - } - -- s->login.len = p++ - s->login.data; -+ s->login.len = p++ - pos; -+ s->login.data = pos; - - s->passwd.len = last - p; - s->passwd.data = p; -@@ -583,24 +584,26 @@ ngx_int_t - ngx_mail_auth_login_username(ngx_mail_session_t *s, ngx_connection_t *c, - ngx_uint_t n) - { -- ngx_str_t *arg; -+ ngx_str_t *arg, login; - - arg = s->args.elts; - - ngx_log_debug1(NGX_LOG_DEBUG_MAIL, c->log, 0, - "mail auth login username: \"%V\"", &arg[n]); - -- s->login.data = ngx_pnalloc(c->pool, ngx_base64_decoded_length(arg[n].len)); -- if (s->login.data == NULL) { -+ login.data = ngx_pnalloc(c->pool, ngx_base64_decoded_length(arg[n].len)); -+ if (login.data == NULL) { - return NGX_ERROR; - } - -- if (ngx_decode_base64(&s->login, &arg[n]) != NGX_OK) { -+ if (ngx_decode_base64(&login, &arg[n]) != NGX_OK) { - ngx_log_error(NGX_LOG_INFO, c->log, 0, - "client sent invalid base64 encoding in AUTH LOGIN command"); - return NGX_MAIL_PARSE_INVALID_COMMAND; - } - -+ s->login = login; -+ - ngx_log_debug1(NGX_LOG_DEBUG_MAIL, c->log, 0, - "mail auth login username: \"%V\"", &s->login); - -@@ -611,7 +614,7 @@ ngx_mail_auth_login_username(ngx_mail_session_t *s, ngx_connection_t *c, - ngx_int_t - ngx_mail_auth_login_password(ngx_mail_session_t *s, ngx_connection_t *c) - { -- ngx_str_t *arg; -+ ngx_str_t *arg, passwd; - - arg = s->args.elts; - -@@ -620,18 +623,19 @@ ngx_mail_auth_login_password(ngx_mail_session_t *s, ngx_connection_t *c) - "mail auth login password: \"%V\"", &arg[0]); - #endif - -- s->passwd.data = ngx_pnalloc(c->pool, -- ngx_base64_decoded_length(arg[0].len)); -- if (s->passwd.data == NULL) { -+ passwd.data = ngx_pnalloc(c->pool, ngx_base64_decoded_length(arg[0].len)); -+ if (passwd.data == NULL) { - return NGX_ERROR; - } - -- if (ngx_decode_base64(&s->passwd, &arg[0]) != NGX_OK) { -+ if (ngx_decode_base64(&passwd, &arg[0]) != NGX_OK) { - ngx_log_error(NGX_LOG_INFO, c->log, 0, - "client sent invalid base64 encoding in AUTH LOGIN command"); - return NGX_MAIL_PARSE_INVALID_COMMAND; - } - -+ s->passwd = passwd; -+ - #if (NGX_DEBUG_MAIL_PASSWD) - ngx_log_debug1(NGX_LOG_DEBUG_MAIL, c->log, 0, - "mail auth login password: \"%V\"", &s->passwd); -@@ -674,24 +678,26 @@ ngx_int_t - ngx_mail_auth_cram_md5(ngx_mail_session_t *s, ngx_connection_t *c) - { - u_char *p, *last; -- ngx_str_t *arg; -+ ngx_str_t *arg, login; - - arg = s->args.elts; - - ngx_log_debug1(NGX_LOG_DEBUG_MAIL, c->log, 0, - "mail auth cram-md5: \"%V\"", &arg[0]); - -- s->login.data = ngx_pnalloc(c->pool, ngx_base64_decoded_length(arg[0].len)); -- if (s->login.data == NULL) { -+ login.data = ngx_pnalloc(c->pool, ngx_base64_decoded_length(arg[0].len)); -+ if (login.data == NULL) { - return NGX_ERROR; - } - -- if (ngx_decode_base64(&s->login, &arg[0]) != NGX_OK) { -+ if (ngx_decode_base64(&login, &arg[0]) != NGX_OK) { - ngx_log_error(NGX_LOG_INFO, c->log, 0, - "client sent invalid base64 encoding in AUTH CRAM-MD5 command"); - return NGX_MAIL_PARSE_INVALID_COMMAND; - } - -+ s->login = login; -+ - p = s->login.data; - last = p + s->login.len; diff --git a/package/nginx/nginx.hash b/package/nginx/nginx.hash index 77220665f3..7b79036b20 100644 --- a/package/nginx/nginx.hash +++ b/package/nginx/nginx.hash @@ -1,4 +1,4 @@ # Locally calculated after checking pgp signature -sha256 69ee2b237744036e61d24b836668aad3040dda461fe6f570f1787eab570c75aa nginx-1.26.3.tar.gz +sha256 40e7a0916d121e8905ef50f2a738b675599e42b2224a582dd938603fed15788e nginx-1.28.1.tar.gz # License files, locally calculated -sha256 f19c4caea60247490199c5a6d0134281e3fb20b3d7577e6873c628597f5381d9 LICENSE +sha256 77c01620abf36ed747b7eca4bd271e49023fe3a8e2b3525bcf4b09c8e3aa28e4 LICENSE diff --git a/package/nginx/nginx.mk b/package/nginx/nginx.mk index 9ea432abdb..41490caee2 100644 --- a/package/nginx/nginx.mk +++ b/package/nginx/nginx.mk @@ -4,7 +4,7 @@ # ################################################################################ -NGINX_VERSION = 1.26.3 +NGINX_VERSION = 1.28.1 NGINX_SITE = https://nginx.org/download NGINX_LICENSE = BSD-2-Clause NGINX_LICENSE_FILES = LICENSE @@ -19,9 +19,6 @@ NGINX_CONF_OPTS = \ --with-cpp="$(TARGET_CC)" \ --with-ld-opt="$(TARGET_LDFLAGS)" -# 0010-CVE-2025-53859.patch -NGINX_IGNORE_CVES += CVE-2025-53859 - # www-data user and group are used for nginx. Because these user and group # are already set by buildroot, it is not necessary to redefine them. # See system/skeleton/etc/passwd