Welcome! Log In Create A New Profile


[nginx-announce] nginx security advisory (CVE-2014-3616)

Posted by Maxim Dounin 
Maxim Dounin
[nginx-announce] nginx security advisory (CVE-2014-3616)
September 16, 2014 10:50AM

A problem with SSL session cache in nginx was identified by Antoine
Delignat-Lavaud. It was possible to reuse cached SSL sessions in
unrelated contexts, allowing virtual host confusion attacks in some
configurations by an attacker in a privileged network position

The problem affects nginx 0.5.6 - 1.7.4 if the same shared
ssl_session_cache and/or ssl_session_ticket_key are used for multiple
server{} blocks.

The problem is fixed in nginx 1.7.5, 1.6.2.

Further details can be found in the paper by Antoine Delignat-Lavaud
et al., available at http://bh.ht.vc/vhost_confusion.pdf.

Maxim Dounin

nginx-announce mailing list
Sorry, you do not have permission to post/reply in this forum.

Online Users

Guests: 183
Record Number of Users: 8 on April 13, 2023
Record Number of Guests: 500 on July 15, 2024
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready