Debian Patches

Status for nginx/1.30.4-7

Patch Description Author Forwarded Bugs Origin Last update
nginx-fix-pidfile.patch Fix NGINX pidfile handling Tj <ubuntu@iam.tj> no debian 2020-06-24
nginx-ssl_cert_cb_yield.patch # HG changeset patch
# User Yichun Zhang <agentzh@openresty.org>
# Date 1451762084 28800
# Sat Jan 02 11:14:44 2016 -0800
# Node ID 449f0461859c16e95bdb18e8be6b94401545d3dd
# Parent 78b4e10b4367b31367aad3c83c9c3acdd42397c4

OpenSSL 1.0.2+ introduces SSL_CTX_set_cert_cb() to allow custom
callbacks to serve the SSL certificiates and private keys dynamically
and lazily. The callbacks may yield for nonblocking I/O or sleeping.
Here we added support for such usage in NGINX 3rd-party modules
(like ngx_lua) in NGINX's event handlers for downstream SSL
connections.

===================================================================		 no https://github.com/openresty/openresty/blob/master/patches/nginx-1.21.4-ssl_cert_cb_yield.patch
override-uname.patch Override uname probing during configure Miao Wang <shankerwangmiao@gmail.com> no 2025-02-13
fix-cache-line-size-for-loongarch64.patch Configure: set cache line size for loongarch64
Section 8.2 table 54, registers 0x11 - 0x14 (2^6 = 64 bytes)
<https://loongson.github.io/LoongArch-Documentation/Loongson-3A5000-usermanual-EN.html#instruction-set-features-implemented-in-3a5000>

There is no intent to cover 32-bit LoongArch which acceptably falls
through to the default.		 Miao Wang <shankerwangmiao@users.noreply.github.com> not-needed https://github.com/nginx/nginx/commit/be84ac8bda2265d254f3ead9c3f0ba1d78a79319 2026-06-22
CVE-2026-90439.patch QUIC: registering the compat extension in all SSL contexts
With the OpenSSL compatibility layer, the transport parameters custom
TLS extension used to be registered only in SSL contexts of virtual
servers reachable over QUIC.

The ClientHello callback introduced in 0373fe5d9 (1.29.2) is called
by OpenSSL between collecting and parsing extensions, so the custom
extensions may not match the expected number if the SSL context was
replaced with SSL_set_SSL_CTX().

The fix is to register the extension in all SSL contexts, including
those that cannot be reached over QUIC, so that the array bounds are
preserved; the compatibility layer as a whole is initialized only
if the configuration has QUIC listeners. The keylog callback,
meaningful for QUIC connections, is kept on QUIC addresses.

Reported by Banny Liao.

Debian backport note:
Keep ngx_quic_compat_init() and the public ngx_event_quic_openssl_compat.h
unchanged for nginx-dev ABI compatibility. Put new declarations in a
private .hh header.		 Sergey Kandaurov <pluknet@nginx.com> no https://github.com/nginx/nginx/commit/78399582a5d6d212e40ffc7f9ca61e6de7852d9c 2026-09-08

All known versions for source package 'nginx'

Links