CVEvulnerability
CVE-2014-3616
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-12-08
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-613
Description
nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct "virtual host confusion" attacks.
Affected configurations
• f5 nginx (>= 0.5.6 < 1.6.2)
• f5 nginx (>= 1.7.0 < 1.7.5)
• debian debian linux 7.0
• debian debian linux 8.0
Related
Weakness · not in database (1)
References
- http://mailman.nginx.org/pipermail/nginx-announce/2014/000147.html Vendor Advisory
- http://www.debian.org/security/2014/dsa-3029 Third Party Advisory
- http://mailman.nginx.org/pipermail/nginx-announce/2014/000147.html Vendor Advisory
- http://www.debian.org/security/2014/dsa-3029 Third Party Advisory