From 7ad10cb7c3b871b2d2dbd9096c555240078f317e Mon Sep 17 00:00:00 2001 From: Hetvi Thakar Date: Mon, 2 Nov 2026 23:04:28 -0800 Subject: [PATCH] nginx: fix CVE-2026-97629 This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/nginx/nginx/commit/fdedba031bf1ad6a80c61b1aec1418d1a87ae296 [2] https://ubuntu.com/security/CVE-2026-97629 Signed-off-by: Hetvi Thakar Signed-off-by: Anuj Mittal --- .../nginx/files/CVE-2026-97629.patch | 45 +++++++++++++++++++ .../recipes-httpd/nginx/nginx_1.28.3.bb | 1 + .../recipes-httpd/nginx/nginx_1.29.7.bb | 1 + 3 files changed, 47 insertions(+) create mode 100644 meta-webserver/recipes-httpd/nginx/files/CVE-2026-97629.patch diff --git a/meta-webserver/recipes-httpd/nginx/files/CVE-2026-97629.patch b/meta-webserver/recipes-httpd/nginx/files/CVE-2026-97629.patch new file mode 100644 index 0000000000..141e54bb0d --- /dev/null +++ b/meta-webserver/recipes-httpd/nginx/files/CVE-2026-97629.patch @@ -0,0 +1,45 @@ +From fdedba031bf1ad6a80c61b1aec1418d1a87ae296 Mon Sep 17 00:00:00 2001 +From: Vadim Zhestikov +Date: Wed, 22 Jul 2026 16:48:37 -0700 +Subject: [PATCH] SSL: synced all session ticket keys to the worker process + +The per-worker ticket key mirror is allocated with three slots +(ngx_array_push_n(keys, 3)), matching the shared memory +ticket_keys[3] array and the decrypt callback, which scans all +keys->nelts slots by key name. Key rotation, however, synced +only two slots from shared memory, leaving the third slot's +name, hmac_key, and aes_key uninitialized. + +A ticket whose key name matched the uninitialized slot (which +holds unspecified pool memory, all zero in the best case) could +therefore be HMAC-verified and decrypted with uninitialized key +material, allowing a forged session. + +Sync all keys->nelts slots, as ngx_ssl_ticket_keys_cleanup() +already assumes. + +Reported by PhiNode Labs. + +CVE: CVE-2026-97629 +Upstream-Status: Backport [https://github.com/nginx/nginx/commit/fdedba031bf1ad6a80c61b1aec1418d1a87ae296] + +Signed-off-by: Hetvi Thakar +--- + src/event/ngx_event_openssl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c +index 1653be0c34..bb6e04313f 100644 +--- a/src/event/ngx_event_openssl.c ++++ b/src/event/ngx_event_openssl.c +@@ -5195,7 +5195,7 @@ ngx_ssl_rotate_ticket_keys(SSL_CTX *ssl_ctx, ngx_log_t *log) + /* sync keys to the worker process memory */ + + ngx_memcpy(keys->elts, cache->ticket_keys, +- 2 * sizeof(ngx_ssl_ticket_key_t)); ++ keys->nelts * sizeof(ngx_ssl_ticket_key_t)); + + ngx_shmtx_unlock(&shpool->mutex); + +-- +2.35.6 diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb index eaf069135a..1ee9d41562 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb +++ b/meta-webserver/recipes-httpd/nginx/nginx_1.28.3.bb @@ -16,6 +16,7 @@ SRC_URI:append = " \ file://CVE-2026-42533_p5.patch \ file://CVE-2026-56434.patch \ file://CVE-2026-95101.patch \ + file://CVE-2026-97629.patch \ " LIC_FILES_CHKSUM = "file://LICENSE;md5=3dc49537b08b14c8b66ad247bb4c4593" diff --git a/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb b/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb index bba4788d5e..77b6303a74 100644 --- a/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb +++ b/meta-webserver/recipes-httpd/nginx/nginx_1.29.7.bb @@ -16,6 +16,7 @@ SRC_URI:append = " \ file://CVE-2026-42533_p5.patch \ file://CVE-2026-56434.patch \ file://CVE-2026-95101.patch \ + file://CVE-2026-97629.patch \ " # 1.28.x branch is the current stable branch, the recommended default