Subject: CVS commit: pkgsrc/www/nginx-devel
From: Sergey A. Osokin
Date: 2025-02-05 19:16:07
Message id: 20250205181607.216D3FBE0@cvs.NetBSD.org

Log Message:
www/nginx-devel: security update 1.27.3 -> 1.27.4

<ChangeLog>

*) Security: insufficient check in virtual servers handling with TLSv1.3
   SNI allowed to reuse SSL sessions in a different virtual server, to
   bypass client SSL certificates verification (CVE-2025-23419).

*) Feature: the "ssl_object_cache_inheritable", \ 
"ssl_certificate_cache",
   "proxy_ssl_certificate_cache", \ 
"grpc_ssl_certificate_cache", and
   "uwsgi_ssl_certificate_cache" directives.

*) Feature: the "keepalive_min_timeout" directive.

*) Workaround: "gzip filter failed to use preallocated memory" alerts
   appeared in logs when using zlib-ng.

*) Bugfix: nginx could not build libatomic library using the library
   sources if the --with-libatomic=DIR option was used.

*) Bugfix: QUIC connection might not be established when using 0-RTT;
   the bug had appeared in 1.27.1.

*) Bugfix: nginx now ignores QUIC version negotiation packets from
   clients.

*) Bugfix: nginx could not be built on Solaris 10 and earlier with the
   ngx_http_v3_module.

*) Bugfixes in HTTP/3.

</ChangeLog>

Files:
RevisionActionfile
1.143modifypkgsrc/www/nginx-devel/Makefile
1.119modifypkgsrc/www/nginx-devel/distinfo