Skip to content

Commit 615d3c2

Browse files
azurelinux-securityKanishk-Bansal
azurelinux-security
and
Kanishk-Bansal
authored
[AutoPR- Security] Patch nginx for CVE-2025-53859 [MEDIUM] (#14547)
Co-authored-by: Kanishk Bansal <[email protected]>
1 parent 6be2f0c commit 615d3c2

File tree

2 files changed

+146
-1
lines changed

2 files changed

+146
-1
lines changed

‎SPECS/nginx/CVE-2025-53859.patch

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
From 26aa1129e6d5920c7327991d693edda3aaa9abf3 Mon Sep 17 00:00:00 2001
2+
From: Azure Linux Security Servicing Account <[email protected]>
3+
Date: Tue, 19 Aug 2025 08:05:07 +0000
4+
Subject: [PATCH] CVE-2025-53859
5+
6+
Signed-off-by: Azure Linux Security Servicing Account <[email protected]>
7+
Upstream-reference: AI Backport of https://nginx.org/download/patch.2025.smtp.txt
8+
---
9+
src/mail/ngx_mail_handler.c | 38 +++++++++++++++++++++----------------
10+
1 file changed, 22 insertions(+), 16 deletions(-)
11+
12+
diff --git a/src/mail/ngx_mail_handler.c b/src/mail/ngx_mail_handler.c
13+
index 1167df3..d3be7f3 100644
14+
--- a/src/mail/ngx_mail_handler.c
15+
+++ b/src/mail/ngx_mail_handler.c
16+
@@ -523,7 +523,7 @@ ngx_mail_starttls_only(ngx_mail_session_t *s, ngx_connection_t *c)
17+
ngx_int_t
18+
ngx_mail_auth_plain(ngx_mail_session_t *s, ngx_connection_t *c, ngx_uint_t n)
19+
{
20+
- u_char *p, *last;
21+
+ u_char *p, *pos, *last;
22+
ngx_str_t *arg, plain;
23+
24+
arg = s->args.elts;
25+
@@ -555,7 +555,7 @@ ngx_mail_auth_plain(ngx_mail_session_t *s, ngx_connection_t *c, ngx_uint_t n)
26+
return NGX_MAIL_PARSE_INVALID_COMMAND;
27+
}
28+
29+
- s->login.data = p;
30+
+ pos = p;
31+
32+
while (p < last && *p) { p++; }
33+
34+
@@ -565,7 +565,8 @@ ngx_mail_auth_plain(ngx_mail_session_t *s, ngx_connection_t *c, ngx_uint_t n)
35+
return NGX_MAIL_PARSE_INVALID_COMMAND;
36+
}
37+
38+
- s->login.len = p++ - s->login.data;
39+
+ s->login.len = p++ - pos;
40+
+ s->login.data = pos;
41+
42+
s->passwd.len = last - p;
43+
s->passwd.data = p;
44+
@@ -583,24 +584,26 @@ ngx_int_t
45+
ngx_mail_auth_login_username(ngx_mail_session_t *s, ngx_connection_t *c,
46+
ngx_uint_t n)
47+
{
48+
- ngx_str_t *arg;
49+
+ ngx_str_t *arg, login;
50+
51+
arg = s->args.elts;
52+
53+
ngx_log_debug1(NGX_LOG_DEBUG_MAIL, c->log, 0,
54+
"mail auth login username: \"%V\"", &arg[n]);
55+
56+
- s->login.data = ngx_pnalloc(c->pool, ngx_base64_decoded_length(arg[n].len));
57+
- if (s->login.data == NULL) {
58+
+ login.data = ngx_pnalloc(c->pool, ngx_base64_decoded_length(arg[n].len));
59+
+ if (login.data == NULL) {
60+
return NGX_ERROR;
61+
}
62+
63+
- if (ngx_decode_base64(&s->login, &arg[n]) != NGX_OK) {
64+
+ if (ngx_decode_base64(&login, &arg[n]) != NGX_OK) {
65+
ngx_log_error(NGX_LOG_INFO, c->log, 0,
66+
"client sent invalid base64 encoding in AUTH LOGIN command");
67+
return NGX_MAIL_PARSE_INVALID_COMMAND;
68+
}
69+
70+
+ s->login = login;
71+
+
72+
ngx_log_debug1(NGX_LOG_DEBUG_MAIL, c->log, 0,
73+
"mail auth login username: \"%V\"", &s->login);
74+
75+
@@ -611,7 +614,7 @@ ngx_mail_auth_login_username(ngx_mail_session_t *s, ngx_connection_t *c,
76+
ngx_int_t
77+
ngx_mail_auth_login_password(ngx_mail_session_t *s, ngx_connection_t *c)
78+
{
79+
- ngx_str_t *arg;
80+
+ ngx_str_t *arg, passwd;
81+
82+
arg = s->args.elts;
83+
84+
@@ -620,18 +623,19 @@ ngx_mail_auth_login_password(ngx_mail_session_t *s, ngx_connection_t *c)
85+
"mail auth login password: \"%V\"", &arg[0]);
86+
#endif
87+
88+
- s->passwd.data = ngx_pnalloc(c->pool,
89+
- ngx_base64_decoded_length(arg[0].len));
90+
- if (s->passwd.data == NULL) {
91+
+ passwd.data = ngx_pnalloc(c->pool, ngx_base64_decoded_length(arg[0].len));
92+
+ if (passwd.data == NULL) {
93+
return NGX_ERROR;
94+
}
95+
96+
- if (ngx_decode_base64(&s->passwd, &arg[0]) != NGX_OK) {
97+
+ if (ngx_decode_base64(&passwd, &arg[0]) != NGX_OK) {
98+
ngx_log_error(NGX_LOG_INFO, c->log, 0,
99+
"client sent invalid base64 encoding in AUTH LOGIN command");
100+
return NGX_MAIL_PARSE_INVALID_COMMAND;
101+
}
102+
103+
+ s->passwd = passwd;
104+
+
105+
#if (NGX_DEBUG_MAIL_PASSWD)
106+
ngx_log_debug1(NGX_LOG_DEBUG_MAIL, c->log, 0,
107+
"mail auth login password: \"%V\"", &s->passwd);
108+
@@ -674,24 +678,26 @@ ngx_int_t
109+
ngx_mail_auth_cram_md5(ngx_mail_session_t *s, ngx_connection_t *c)
110+
{
111+
u_char *p, *last;
112+
- ngx_str_t *arg;
113+
+ ngx_str_t *arg, login;
114+
115+
arg = s->args.elts;
116+
117+
ngx_log_debug1(NGX_LOG_DEBUG_MAIL, c->log, 0,
118+
"mail auth cram-md5: \"%V\"", &arg[0]);
119+
120+
- s->login.data = ngx_pnalloc(c->pool, ngx_base64_decoded_length(arg[0].len));
121+
- if (s->login.data == NULL) {
122+
+ login.data = ngx_pnalloc(c->pool, ngx_base64_decoded_length(arg[0].len));
123+
+ if (login.data == NULL) {
124+
return NGX_ERROR;
125+
}
126+
127+
- if (ngx_decode_base64(&s->login, &arg[0]) != NGX_OK) {
128+
+ if (ngx_decode_base64(&login, &arg[0]) != NGX_OK) {
129+
ngx_log_error(NGX_LOG_INFO, c->log, 0,
130+
"client sent invalid base64 encoding in AUTH CRAM-MD5 command");
131+
return NGX_MAIL_PARSE_INVALID_COMMAND;
132+
}
133+
134+
+ s->login = login;
135+
+
136+
p = s->login.data;
137+
last = p + s->login.len;
138+
139+
--
140+
2.45.4
141+

‎SPECS/nginx/nginx.spec

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ Name: nginx
66
# Currently on "stable" version of nginx from https://nginx.org/en/download.html.
77
# Note: Stable versions are even (1.20), mainline versions are odd (1.21)
88
Version: 1.25.4
9-
Release: 4%{?dist}
9+
Release: 5%{?dist}
1010
License: BSD-2-Clause
1111
Vendor: Microsoft Corporation
1212
Distribution: Azure Linux
@@ -22,6 +22,7 @@ Source3: nginx-tests.tgz
2222

2323
Patch0: CVE-2024-7347.patch
2424
Patch1: CVE-2025-23419.patch
25+
Patch2: CVE-2025-53859.patch
2526
BuildRequires: libxml2-devel
2627
BuildRequires: libxslt-devel
2728
BuildRequires: openssl-devel
@@ -163,6 +164,9 @@ rm -rf nginx-tests
163164
%dir %{_sysconfdir}/%{name}
164165

165166
%changelog
167+
* Tue Aug 19 2025 Azure Linux Security Servicing Account <[email protected]> - 1.25.4-5
168+
- Patch for CVE-2025-53859
169+
166170
* Tue Mar 11 2025 Sandeep Karambelkar <[email protected]> - 1.25.4-4
167171
- Enable webdav module
168172
- Added tests to verify nginx server and its supported modules

0 commit comments

Comments
 (0)