From 25e4a15f2ade9d8fb33a97603cd99652e6870d42 Mon Sep 17 00:00:00 2001 From: Thomas Gerbet Date: Fri, 31 May 2024 11:30:28 +0200 Subject: [PATCH] nginx: 1.26.0 -> 1.26.1 Fixes CVE-2024-32760, CVE-2024-31079, CVE-2024-35200 and CVE-2024-34161. Note that the `nginxQuic` derivation rely on `nginxMainline`. Changes: ``` Changes with nginx 1.26.1 29 May 2024 *) Security: when using HTTP/3, processing of a specially crafted QUIC session might cause a worker process crash, worker process memory disclosure on systems with MTU larger than 4096 bytes, or might have potential other impact (CVE-2024-32760, CVE-2024-31079, CVE-2024-35200, CVE-2024-34161). Thanks to Nils Bars of CISPA. *) Bugfix: reduced memory consumption for long-lived requests if "gzip", "gunzip", "ssi", "sub_filter", or "grpc_pass" directives are used. *) Bugfix: nginx could not be built by gcc 14 if the --with-atomic option was used. Thanks to Edgar Bonet. *) Bugfix: in HTTP/3. ``` --- pkgs/servers/http/nginx/stable.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/http/nginx/stable.nix b/pkgs/servers/http/nginx/stable.nix index cc6a521af662..3a6a049c1206 100644 --- a/pkgs/servers/http/nginx/stable.nix +++ b/pkgs/servers/http/nginx/stable.nix @@ -1,6 +1,6 @@ { callPackage, ... } @ args: callPackage ./generic.nix args { - version = "1.26.0"; - hash = "sha256-0ubIQ51sbbUBXY6qskcKtSrvhae/NjGCh5l34IQ3BJc="; + version = "1.26.1"; + hash = "sha256-+Rh0aP8usVkmC/1Thnwl/44zRyYjes8ie56HDlPT42s="; }