Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package nginx for openSUSE:Factory checked in at 2026-10-15 18:20:19 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/nginx (Old) and /work/SRC/openSUSE:Factory/.nginx.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "nginx" Thu Oct 15 18:20:19 2026 rev:120 rq:1384825 version:1.31.7 Changes: -------- --- /work/SRC/openSUSE:Factory/nginx/nginx.changes 2026-09-17 15:15:55.326163787 +0200 +++ /work/SRC/openSUSE:Factory/.nginx.new.3698736/nginx.changes 2026-10-15 18:20:30.090337553 +0200 @@ -1,0 +2,55 @@ +Wed Oct 14 16:07:34 UTC 2026 - Marcus Rueckert <[email protected]> + +- Update to 1.31.7 + - Security: a buffer overflow might occur in a worker process + when using the "alias" directive if the request URI was changed + by the "rewrite" directive and was then mapped to a file path + (CVE-2026-15176). + - Security: a buffer overflow might occur in a worker process + while evaluating string expressions with variables, which + affected the document root calculation and request logging in + the http and stream modules (CVE-2026-93479). Thanks to Matt + Suiche of Tolmo Inc. + - Security: when using HTTP/3 a part of an unknown frame might be + treated as the request body, which might result in bypassing + the "client_max_body_size" limit or injecting data in the + proxied request (CVE-2026-95101). Thanks to Hansol Lee of + GOTROOT. + - Security: when using TLS session ticket key rotation, one of + the keys was left uninitialized, which might allow to forge a + session (CVE-2026-97629). Thanks to PhiNode Labs. + - Security: when using asynchronous file I/O (AIO), + use-after-free might occur in certain configurations if the SSI + page has "include virtual" commands (CVE-2026-97205). Thanks to + cyberlancer. + - Feature: the ngx_http_geoip_module and ngx_stream_geoip_module + now support databases in the MaxMind DB (MMDB) format. + - Feature: now backend SSL certificates can be verified by IP + address. Thanks to Maxim Dounin. + - Feature: now QUIC supports reconfiguration and binary upgrade + when using the "quic_bpf" directive. + - Change: the ngx_http_v2_module now uses the RFC 9218 + prioritization scheme, and RFC 7540 priority signals are + ignored. + - Bugfix: a segmentation fault might occur in a worker process or + "request count is zero" alerts might appear in logs if the + "X-Accel-Redirect" header line was cached and the cached + response was then served to a client. Thanks to Jiří Setnička + and Maxim Dounin. + - Bugfix: a segmentation fault might occur in a worker process if + the ngx_http_dav_module was used to handle COPY and MOVE + methods in a location with the "alias" directive. Thanks to + Maxim Dounin. + - Bugfix: QUIC connections might be closed with the "quic flood + detected" message in logs if the "http3_stream_buffer_size" + directive was set to a small value; the bug had appeared in + 1.27.5. + - Bugfix: closing an SSL connection without close_notify was + treated as a clean shutdown, including the case when the + connection was reset; now "SSL_read() failed" errors appear in + logs in this case. Thanks to Maxim Dounin. + - Bugfix: "[crit] SSL_write() failed" messages might appear in + logs when an error occurred while reading from an SSL + connection. + +------------------------------------------------------------------- Old: ---- nginx-1.31.6.tar.gz nginx-1.31.6.tar.gz.asc New: ---- nginx-1.31.7.tar.gz nginx-1.31.7.tar.gz.asc ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ nginx.spec ++++++ --- /var/tmp/diff_new_pack.IJR79v/_old 2026-10-15 18:20:32.085421084 +0200 +++ /var/tmp/diff_new_pack.IJR79v/_new 2026-10-15 18:20:32.089421251 +0200 @@ -24,7 +24,7 @@ %bcond_with awslc # Name: nginx -Version: 1.31.6 +Version: 1.31.7 Release: 0 Summary: A HTTP server and IMAP/POP3 proxy server License: BSD-2-Clause ++++++ nginx-1.31.6.tar.gz -> nginx-1.31.7.tar.gz ++++++ ++++ 7357 lines of diff (skipped)
