Skip to content

1.34.2 release #192

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Mar 3, 2025
Merged

1.34.2 release #192

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f008986
Add 1.34.2 release page
ac000 Feb 25, 2025
bf276dc
Update CHANGES.txt for 1.34.2
ac000 Feb 27, 2025
2b977b5
conf.py: Update for 1.34.2
ac000 Feb 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions source/CHANGES.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,13 @@
Changes with Unit 1.34.2 26 Feb 2025

*) Security: fix missing websocket payload length validation in the Java
language module which could lead to Java language module processes
consuming excess CPU. (CVE-2025-1695).

*) Bugfix: fix incorrect websocket payload length calculation in the
Java language module.


Changes with Unit 1.34.1 10 Jan 2025

*) Bugfix: fix instability issues due to OpenTelemetry (OTEL) support.
Expand Down
4 changes: 2 additions & 2 deletions source/conf.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,8 @@
project = 'NGINX Unit'
author = 'NGINX, Inc.'
copyright = '2017-2025'
version = '1.34.1'
release_date = 'Jan 10, 2025'
version = '1.34.2'
release_date = 'Feb 26, 2025'
release = version
needs_sphinx = '6.2'

Expand Down
10 changes: 10 additions & 0 deletions source/news/2025/index.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,18 @@
News of 2025
############


News archive for the year 2025.

.. nxt_news_entry::
:author: Unit Team
:description: Version 1.34.2 is a maintenance release that fixes a couple
of Java WebSocket issues.
:email: [email protected]
:title: Unit 1.34.2 Released
:url: news/2025/unit-1.34.2-released
:date: 2025-02-26

.. nxt_news_entry::
:author: Unit Team
:description: Version 1.34.1 is a maintenance release that fixes issues
Expand Down
37 changes: 37 additions & 0 deletions source/news/2025/unit-1.34.2-released.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
:orphan:

####################
Unit 1.34.2 Released
####################

We are pleased to announce the release of NGINX Unit 1.34.2. This is a
maintenance release that fixes a couple of issues in the Java WebSocket
code within the Java language module.

- Security: When the NGINX Unit Java Language module is in use, undisclosed
requests can lead to an infinite loop and cause an increase in CPU resource
utilization (CVE-2025-1695).

`F5 SIRT <https://my.f5.com/manage/s/article/K000149959>`__.

- It addresses an issue whereby decoded payload lengths would be limited
to 32 bits.

Both these issues affect Unit versions from 1.11.0 to 1.34.1. If you use
the Java language module with WebSockets it is strongly suggested to
upgrade.

**************
Full Changelog
**************

.. code-block:: none

Changes with Unit 1.34.2 26 Feb 2025

*) Security: fix missing websocket payload length validation in the Java
language module which could lead to Java language module processes
consuming excess CPU. (CVE-2025-1695).

*) Bugfix: fix incorrect websocket payload length calculation in the
Java language module.