Public bug reported:
Any config relying on $1 from a `location ~ regex {}` block returns a
corrupted value: shifted left by one character and missing the last
character.
Package: nginx (1.24.0-2ubuntu7.16)
Regression: not observed in 1.24.0-2ubuntu7.15; started immediately after
upgrading to .16 in production.
Steps to reproduce:
mkdir -p /tmp/repro
echo "<?php echo 'test'; ?>" > /tmp/repro/index.php
/etc/nginx/sites-enabled/99-repro-bug.conf:
server {
listen 127.0.0.1:8080;
server_name repro.local;
root /tmp/repro;
index index.php index.html;
location ~ ^/(.*\.php)$ {
add_header X-Captured "$1" always;
return 204;
}
}
curl -sI http://127.0.0.1:8080/index.php | grep -i x-captured
Expected: X-Captured: index.php
Actual: X-Captured: /index.ph
100% reproducible and deterministic across repeated requests. Confirmed
with two independent directives (return and add_header), ruling out a
directive-specific artifact.
Impact: this pattern ($1 in location regex, used for FastCGI
SCRIPT_FILENAME or static file alias) is extremely common. In our case
it broke PHP-FPM script resolution and static asset serving (alias) in a
production Roundcube webmail deployment behind iRedMail, causing a full
outage of webmail root/login page and static assets after this security
upgrade was applied via unattended-upgrades.
nginx -V output:
nginx version: nginx/1.24.0 (Ubuntu)
built with OpenSSL 3.0.13 30 Jan 2024
TLS SNI support enabled
configure arguments: --with-cc-opt='-g -O2 -fno-omit-frame-pointer
-mno-omit-leaf-frame-pointer
-ffile-prefix-map=/build/nginx-yYKIIa/nginx-1.24.0=. -flto=auto
-ffat-lto-objects -fstack-protector-strong -fstack-clash-protection -Wformat
-Werror=format-security -fcf-protection
-fdebug-prefix-map=/build/nginx-yYKIIa/nginx-1.24.0=/usr/src/nginx-1.24.0-2ubuntu7.16
-fPIC -Wdate-time -D_FORTIFY_SOURCE=3' --with-ld-opt='-Wl,-Bsymbolic-functions
-flto=auto -ffat-lto-objects -Wl,-z,relro -Wl,-z,now -fPIC'
--prefix=/usr/share/nginx --conf-path=/etc/nginx/nginx.conf
--http-log-path=/var/log/nginx/access.log --error-log-path=stderr
--lock-path=/var/lock/nginx.lock --pid-path=/run/nginx.pid
--modules-path=/usr/lib/nginx/modules
--http-client-body-temp-path=/var/lib/nginx/body
--http-fastcgi-temp-path=/var/lib/nginx/fastcgi
--http-proxy-temp-path=/var/lib/nginx/proxy
--http-scgi-temp-path=/var/lib/nginx/scgi
--http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-compat --with-debug
--with-pcre-jit --with-http_ssl_module --with-http_stub_status_module
--with-http_realip_module --with-http_auth_request_module --with-http_v2_module
--with-http_dav_module --with-http_slice_module --with-threads
--with-http_addition_module --with-http_flv_module --with-http_gunzip_module
--with-http_gzip_static_module --with-http_mp4_module
--with-http_random_index_module --with-http_secure_link_module
--with-http_sub_module --with-mail_ssl_module --with-stream_ssl_module
--with-stream_ssl_preread_module --with-stream_realip_module
--with-http_geoip_module=dynamic --with-http_image_filter_module=dynamic
--with-http_perl_module=dynamic --with-http_xslt_module=dynamic
--with-mail=dynamic --with-stream=dynamic --with-stream_geoip_module=dynamic
** Affects: nginx (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2164647
Title:
Regex capture ($1) corrupted (shifted + truncated) in location block —
nginx 1.24.0-2ubuntu7.16
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/nginx/+bug/2164647/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
