From fa5676ed6e43bb202fffca14cd94446257bd6b9a Mon Sep 17 00:00:00 2001 From: Eliot Berriot Date: Tue, 29 Jan 2019 10:21:57 +0100 Subject: [PATCH] Fix #678: Removed potential BREACH exploit because of Gzip compression --- CHANGELOG | 8 ------- changes/changelog.d/678.bugfix | 1 + changes/notes.rst | 44 +++++++++++++++++++++++++++++++++- deploy/docker.proxy.template | 8 ------- deploy/nginx.template | 8 ------- docker/nginx/conf.dev | 8 ------- 6 files changed, 44 insertions(+), 33 deletions(-) create mode 100644 changes/changelog.d/678.bugfix diff --git a/CHANGELOG b/CHANGELOG index 0b8505669..e5444df94 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -189,19 +189,11 @@ in the server block, then reload your nginx server:: gzip_vary on; gzip_types - application/atom+xml application/javascript - application/json - application/ld+json - application/activity+json - application/manifest+json - application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json - application/xhtml+xml - application/xml font/opentype image/bmp image/svg+xml diff --git a/changes/changelog.d/678.bugfix b/changes/changelog.d/678.bugfix new file mode 100644 index 000000000..ba508bb87 --- /dev/null +++ b/changes/changelog.d/678.bugfix @@ -0,0 +1 @@ +Removed potential BREACH exploit because of Gzip compression (#678) diff --git a/changes/notes.rst b/changes/notes.rst index 8e54adf8b..1276dd010 100644 --- a/changes/notes.rst +++ b/changes/notes.rst @@ -6,6 +6,49 @@ Next release notes Those release notes refer to the current development branch and are reset after each release. +Fix Gzip compression to avoid BREACH exploit [security] [manual action required] +-------------------------------------------------------------------------------- + +In the 0.18 release, we've enabled Gzip compression by default for various +content types, including HTML and JSON. Unfortunately, enabling Gzip compression +on such content types could make BREACH-type exploits possible. + +We've removed the risky content-types from our nginx template files, to ensure new +instances are safe, however, if you already have an instance, you need +to double check that your host nginx virtualhost do not include the following +values for the ``gzip_types`` settings:: + + application/atom+xml + application/json + application/ld+json + application/activity+json + application/manifest+json + application/rss+xml + application/xhtml+xml + application/xml + +For convenience, you can also replace the whole setting with the following snippet:: + + gzip_types + application/javascript + application/vnd.geo+json + application/vnd.ms-fontobject + application/x-font-ttf + application/x-web-app-manifest+json + font/opentype + image/bmp + image/svg+xml + image/x-icon + text/cache-manifest + text/css + text/plain + text/vcard + text/vnd.rim.location.xloc + text/vtt + text/x-component + text/x-cross-domain-policy; + + Fix Apache configuration file for 0.18 [manual action required] ---------------------------------------------------------- @@ -39,4 +82,3 @@ In case you are using custom css and theming, you also need to match this block: ProxyPass "/custom" "!" Alias /custom /srv/funkwhale/custom - diff --git a/deploy/docker.proxy.template b/deploy/docker.proxy.template index c4f89057d..0fbed2f73 100644 --- a/deploy/docker.proxy.template +++ b/deploy/docker.proxy.template @@ -37,19 +37,11 @@ server { gzip_vary on; gzip_types - application/atom+xml application/javascript - application/json - application/ld+json - application/activity+json - application/manifest+json - application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json - application/xhtml+xml - application/xml font/opentype image/bmp image/svg+xml diff --git a/deploy/nginx.template b/deploy/nginx.template index 125397ea3..7cdee70f4 100644 --- a/deploy/nginx.template +++ b/deploy/nginx.template @@ -51,19 +51,11 @@ server { gzip_vary on; gzip_types - application/atom+xml application/javascript - application/json - application/ld+json - application/activity+json - application/manifest+json - application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json - application/xhtml+xml - application/xml font/opentype image/bmp image/svg+xml diff --git a/docker/nginx/conf.dev b/docker/nginx/conf.dev index ecb1c1d0c..50c3cbc2e 100644 --- a/docker/nginx/conf.dev +++ b/docker/nginx/conf.dev @@ -51,19 +51,11 @@ http { gzip_vary on; gzip_types - application/atom+xml application/javascript - application/json - application/ld+json - application/activity+json - application/manifest+json - application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json - application/xhtml+xml - application/xml font/opentype image/bmp image/svg+xml