- Update to 1.17.9
* https://nginx.org/en/CHANGES
* Now nginx does not allow several "Host" request header lines.
* nginx ignored additional "Transfer-Encoding" request header lines.
* Socket leak when using HTTP/2.
* A segmentation fault might occur in a worker process if OCSP
stapling was used.
* In the ngx_http_mp4_module.
* nginx used status code 494 instead of 400 if errors with code
494 were redirected with the "error_page" directive.
* Socket leak when using subrequests in the njs module and the
"aio" directive.
OBS-URL: https://build.opensuse.org/request/show/781491
OBS-URL: https://build.opensuse.org/package/show/server:http/nginx?expand=0&rev=158
* Feature: variables support in the "grpc_pass" directive.
* Bugfix: a timeout might occur while handling pipelined requests
in an SSL connection; the bug had appeared in 1.17.5.
* Bugfix: in the "debug_points" directive when using HTTP/2.
Thanks to Daniil Bondarev.
OBS-URL: https://build.opensuse.org/package/show/server:http/nginx?expand=0&rev=156
- Refresh spec-file via spec-cleaner.
- Add in service-file Wants=network-online.target (boo#1155690)
- Update to 1.17.7
* https://nginx.org/en/CHANGES
* A segmentation fault might occur on start or during
reconfiguration if the "rewrite" directive with an empty
replacement string was used in the configuration.
* A segmentation fault might occur in a worker process if the
"break" directive was used with the "alias" directive or with
the "proxy_pass" directive with a URI.
* The "Location" response header line might contain garbage if
the request URI was rewritten to the one containing a null character.
* Requests with bodies were handled incorrectly when returning redirections
with the "error_page" directive; the bug had appeared in 0.7.12.
* Socket leak when using HTTP/2.
* A timeout might occur while handling pipelined requests in an
SSL connection; the bug had appeared in 1.17.5.
* Bugfix in the ngx_http_dav_module.
OBS-URL: https://build.opensuse.org/request/show/759769
OBS-URL: https://build.opensuse.org/package/show/server:http/nginx?expand=0&rev=152
- Update to 1.17.4
* https://nginx.org/en/CHANGES
* Better detection of incorrect client behavior in HTTP/2.
* In handling of not fully read client request body when
returning errors in HTTP/2.
* The "worker_shutdown_timeout" directive might not work when
using HTTP/2.
* A segmentation fault might occur in a worker process when
using HTTP/2 and the "proxy_request_buffering" directive.
* The ECONNABORTED error log level was "crit" instead of
"error" on Windows when using SSL.
* nginx ignored extra data when using chunked transfer
encoding.
* nginx always returned the 500 error if the "return" directive
was used and an error occurred during reading client request body.
* In memory allocation error handling.
OBS-URL: https://build.opensuse.org/request/show/741628
OBS-URL: https://build.opensuse.org/package/show/server:http/nginx?expand=0&rev=144
- update to 1.17.3
- Security: when using HTTP/2 a client might cause excessive
memory consumption and CPU usage (CVE-2019-9511, CVE-2019-9513,
CVE-2019-9516).
- Bugfix: "zero size buf" alerts might appear in logs when using
gzipping; the bug had appeared in 1.17.2.
- Bugfix: a segmentation fault might occur in a worker process if
the "resolver" directive was used in SMTP proxy. (forwarded request 723395 from darix)
OBS-URL: https://build.opensuse.org/request/show/723397
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/nginx?expand=0&rev=39
- update to 1.17.3
- Security: when using HTTP/2 a client might cause excessive
memory consumption and CPU usage (CVE-2019-9511, CVE-2019-9513,
CVE-2019-9516).
- Bugfix: "zero size buf" alerts might appear in logs when using
gzipping; the bug had appeared in 1.17.2.
- Bugfix: a segmentation fault might occur in a worker process if
the "resolver" directive was used in SMTP proxy.
OBS-URL: https://build.opensuse.org/request/show/723395
OBS-URL: https://build.opensuse.org/package/show/server:http/nginx?expand=0&rev=142
- Feature: the "limit_req_dry_run" directive.
- Feature: when using the "hash" directive inside the "upstream"
block an empty hash key now triggers round-robin balancing.
Thanks to Niklas Keller.
- Bugfix: a segmentation fault might occur in a worker process if
caching was used along with the "image_filter" directive, and
errors with code 415 were redirected with the "error_page"
directive; the bug had appeared in 1.11.10.
- Bugfix: a segmentation fault might occur in a worker process if
embedded perl was used; the bug had appeared in 1.7.3.
OBS-URL: https://build.opensuse.org/package/show/server:http/nginx?expand=0&rev=138
- update to 1.15.6
- Security: when using HTTP/2 a client might cause excessive memory
consumption (CVE-2018-16843) and CPU usage (CVE-2018-16844).
- Security: processing of a specially crafted mp4 file with the
ngx_http_mp4_module might result in worker process memory disclosure
(CVE-2018-16845).
- Feature: the "proxy_socket_keepalive", "fastcgi_socket_keepalive",
"grpc_socket_keepalive", "memcached_socket_keepalive",
"scgi_socket_keepalive", and "uwsgi_socket_keepalive" directives.
- Bugfix: if nginx was built with OpenSSL 1.1.0 and used with OpenSSL
1.1.1, the TLS 1.3 protocol was always enabled.
- Bugfix: working with gRPC backends might result in excessive memory
consumption.
- Fix vim-plugin-nginx rpm group.
- update to 1.15.4
- Feature: now the "ssl_early_data" directive can be used with OpenSSL.
- Bugfix: in the ngx_http_uwsgi_module.
- Bugfix: connections with some gRPC backends might not be cached when
using the "keepalive" directive.
- Bugfix: a socket leak might occur when using the "error_page"
directive to redirect early request processing errors, notably errors
with code 400.
- Bugfix: the "return" directive did not change the response code when
returning errors if the request was redirected by the "error_page"
directive.
- Bugfix: standard error pages and responses of the
ngx_http_autoindex_module module used the "bgcolor" attribute, and
might be displayed incorrectly when using custom color settings in
browsers.
OBS-URL: https://build.opensuse.org/request/show/647300
OBS-URL: https://build.opensuse.org/package/show/server:http/nginx?expand=0&rev=125
- Feature: now TLSv1.3 can be used with BoringSSL.
- Feature: the "ssl_early_data" directive, currently available
with BoringSSL.
- Feature: the "keepalive_timeout" and "keepalive_requests"
directives in the "upstream" block.
- Bugfix: the ngx_http_dav_module did not truncate destination
file when copying a file over an existing one with the COPY
method.
- Bugfix: the ngx_http_dav_module used zero access rights on the
destination file and did not preserve file modification time
when moving a file between different file systems with the MOVE
method.
- Bugfix: the ngx_http_dav_module used default access rights when
copying a file with the COPY method.
- Workaround: some clients might not work when using HTTP/2; the
bug had appeared in 1.13.5.
- Bugfix: nginx could not be built with LibreSSL 2.8.0.
OBS-URL: https://build.opensuse.org/package/show/server:http/nginx?expand=0&rev=119
