Skip to content

Commit 705d7b8

Browse files
azurelinux-securityKanishk-Bansal
azurelinux-security
and
Kanishk-Bansal
authored
[AutoPR- Security] Patch nginx for CVE-2025-53859 [MEDIUM] (#14548)
Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com>
1 parent fd6d1ee commit 705d7b8

2 files changed

Lines changed: 149 additions & 1 deletion

File tree

‎SPECS/nginx/CVE-2025-53859.patch‎

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
From 1b73bd8671fac4e4c0fc014c3d176a6301dfdcb0 Mon Sep 17 00:00:00 2001
2+
From: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
3+
Date: Tue, 19 Aug 2025 09:20:19 +0000
4+
Subject: [PATCH] CVE-2025-53859
5+
6+
Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
7+
Upstream-reference: AI Backport of https://nginx.org/download/patch.2025.smtp.txt
8+
---
9+
src/mail/ngx_mail_handler.c | 41 ++++++++++++++++++++++---------------
10+
1 file changed, 25 insertions(+), 16 deletions(-)
11+
12+
diff --git a/src/mail/ngx_mail_handler.c b/src/mail/ngx_mail_handler.c
13+
index 246ba97..ae56004 100644
14+
--- a/src/mail/ngx_mail_handler.c
15+
+++ b/src/mail/ngx_mail_handler.c
16+
@@ -523,7 +523,7 @@ ngx_mail_starttls_only(ngx_mail_session_t *s, ngx_connection_t *c)
17+
ngx_int_t
18+
ngx_mail_auth_plain(ngx_mail_session_t *s, ngx_connection_t *c, ngx_uint_t n)
19+
{
20+
- u_char *p, *last;
21+
+ u_char *p, *pos, *last;
22+
ngx_str_t *arg, plain;
23+
24+
arg = s->args.elts;
25+
@@ -555,7 +555,7 @@ ngx_mail_auth_plain(ngx_mail_session_t *s, ngx_connection_t *c, ngx_uint_t n)
26+
return NGX_MAIL_PARSE_INVALID_COMMAND;
27+
}
28+
29+
- s->login.data = p;
30+
+ pos = p;
31+
32+
while (p < last && *p) { p++; }
33+
34+
@@ -565,7 +565,8 @@ ngx_mail_auth_plain(ngx_mail_session_t *s, ngx_connection_t *c, ngx_uint_t n)
35+
return NGX_MAIL_PARSE_INVALID_COMMAND;
36+
}
37+
38+
- s->login.len = p++ - s->login.data;
39+
+ s->login.len = p++ - pos;
40+
+ s->login.data = pos;
41+
42+
s->passwd.len = last - p;
43+
s->passwd.data = p;
44+
@@ -583,24 +584,27 @@ ngx_int_t
45+
ngx_mail_auth_login_username(ngx_mail_session_t *s, ngx_connection_t *c,
46+
ngx_uint_t n)
47+
{
48+
- ngx_str_t *arg;
49+
+ ngx_str_t *arg, login;
50+
51+
arg = s->args.elts;
52+
53+
ngx_log_debug1(NGX_LOG_DEBUG_MAIL, c->log, 0,
54+
"mail auth login username: \"%V\"", &arg[n]);
55+
56+
- s->login.data = ngx_pnalloc(c->pool, ngx_base64_decoded_length(arg[n].len));
57+
- if (s->login.data == NULL) {
58+
+ login.data = ngx_pnalloc(c->pool, ngx_base64_decoded_length(arg[n].len));
59+
+ if (login.data == NULL) {
60+
return NGX_ERROR;
61+
}
62+
63+
- if (ngx_decode_base64(&s->login, &arg[n]) != NGX_OK) {
64+
+ if (ngx_decode_base64(&login, &arg[n]) != NGX_OK) {
65+
ngx_log_error(NGX_LOG_INFO, c->log, 0,
66+
"client sent invalid base64 encoding in AUTH LOGIN command");
67+
return NGX_MAIL_PARSE_INVALID_COMMAND;
68+
}
69+
70+
+
71+
+ s->login = login;
72+
+
73+
ngx_log_debug1(NGX_LOG_DEBUG_MAIL, c->log, 0,
74+
"mail auth login username: \"%V\"", &s->login);
75+
76+
@@ -611,7 +615,7 @@ ngx_mail_auth_login_username(ngx_mail_session_t *s, ngx_connection_t *c,
77+
ngx_int_t
78+
ngx_mail_auth_login_password(ngx_mail_session_t *s, ngx_connection_t *c)
79+
{
80+
- ngx_str_t *arg;
81+
+ ngx_str_t *arg, passwd;
82+
83+
arg = s->args.elts;
84+
85+
@@ -620,18 +624,20 @@ ngx_mail_auth_login_password(ngx_mail_session_t *s, ngx_connection_t *c)
86+
"mail auth login password: \"%V\"", &arg[0]);
87+
#endif
88+
89+
- s->passwd.data = ngx_pnalloc(c->pool,
90+
- ngx_base64_decoded_length(arg[0].len));
91+
- if (s->passwd.data == NULL) {
92+
+ passwd.data = ngx_pnalloc(c->pool, ngx_base64_decoded_length(arg[0].len));
93+
+ if (passwd.data == NULL) {
94+
return NGX_ERROR;
95+
}
96+
97+
- if (ngx_decode_base64(&s->passwd, &arg[0]) != NGX_OK) {
98+
+ if (ngx_decode_base64(&passwd, &arg[0]) != NGX_OK) {
99+
ngx_log_error(NGX_LOG_INFO, c->log, 0,
100+
"client sent invalid base64 encoding in AUTH LOGIN command");
101+
return NGX_MAIL_PARSE_INVALID_COMMAND;
102+
}
103+
104+
+ s->passwd = passwd;
105+
+
106+
+
107+
#if (NGX_DEBUG_MAIL_PASSWD)
108+
ngx_log_debug1(NGX_LOG_DEBUG_MAIL, c->log, 0,
109+
"mail auth login password: \"%V\"", &s->passwd);
110+
@@ -674,24 +680,27 @@ ngx_int_t
111+
ngx_mail_auth_cram_md5(ngx_mail_session_t *s, ngx_connection_t *c)
112+
{
113+
u_char *p, *last;
114+
- ngx_str_t *arg;
115+
+ ngx_str_t *arg, login;
116+
117+
arg = s->args.elts;
118+
119+
ngx_log_debug1(NGX_LOG_DEBUG_MAIL, c->log, 0,
120+
"mail auth cram-md5: \"%V\"", &arg[0]);
121+
122+
- s->login.data = ngx_pnalloc(c->pool, ngx_base64_decoded_length(arg[0].len));
123+
- if (s->login.data == NULL) {
124+
+ login.data = ngx_pnalloc(c->pool, ngx_base64_decoded_length(arg[0].len));
125+
+ if (login.data == NULL) {
126+
return NGX_ERROR;
127+
}
128+
129+
- if (ngx_decode_base64(&s->login, &arg[0]) != NGX_OK) {
130+
+ if (ngx_decode_base64(&login, &arg[0]) != NGX_OK) {
131+
ngx_log_error(NGX_LOG_INFO, c->log, 0,
132+
"client sent invalid base64 encoding in AUTH CRAM-MD5 command");
133+
return NGX_MAIL_PARSE_INVALID_COMMAND;
134+
}
135+
136+
+ s->login = login;
137+
+
138+
+
139+
p = s->login.data;
140+
last = p + s->login.len;
141+
142+
--
143+
2.45.4
144+

‎SPECS/nginx/nginx.spec‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ Name: nginx
77
# Currently on "stable" version of nginx from https://nginx.org/en/download.html.
88
# Note: Stable versions are even (1.20), mainline versions are odd (1.21)
99
Version: 1.22.1
10-
Release: 13%{?dist}
10+
Release: 14%{?dist}
1111
License: BSD-2-Clause
1212
Vendor: Microsoft Corporation
1313
Distribution: Mariner
@@ -20,6 +20,7 @@ Source3: https://github.com/open-telemetry/opentelemetry-cpp-contrib/arch
2020
Patch0: CVE-2023-44487.patch
2121
Patch1: CVE-2024-7347.patch
2222
Patch2: CVE-2025-23419.patch
23+
Patch3: CVE-2025-53859.patch
2324
BuildRequires: libxml2-devel
2425
BuildRequires: libxslt-devel
2526
BuildRequires: openssl-devel
@@ -147,6 +148,9 @@ exit 0
147148
%{_sysconfdir}/%{name}/modules/otel_ngx_module.so
148149

149150
%changelog
151+
* Tue Aug 19 2025 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.22.1-14
152+
- Patch for CVE-2025-53859
153+
150154
* Mon Fev 10 2025 Mitch Zhu <mitchzhu@microsoft.com> - 1.22.1-13
151155
- Fix CVE-2025-23419
152156

0 commit comments

Comments
 (0)