Welcome! Log In Create A New Profile

Advanced

Re: [nginx-announce] nginx security advisory (CVE-2014-3616)

Christos Trochalakis
September 17, 2014 04:00AM
On Tue, Sep 16, 2014 at 06:47:20PM +0400, Maxim Dounin wrote:
>Hello!
>
>A problem with SSL session cache in nginx was identified by Antoine
>Delignat-Lavaud. It was possible to reuse cached SSL sessions in
>unrelated contexts, allowing virtual host confusion attacks in some
>configurations by an attacker in a privileged network position
>(CVE-2014-3616).
>
>The problem affects nginx 0.5.6 - 1.7.4 if the same shared
>ssl_session_cache and/or ssl_session_ticket_key are used for multiple
>server{} blocks.
>
>The problem is fixed in nginx 1.7.5, 1.6.2.
>
>Further details can be found in the paper by Antoine Delignat-Lavaud
>et al., available at http://bh.ht.vc/vhost_confusion.pdf.
>

Hello all,

I am one of the debian nginx maintainers. Is it possible to provide a
patch for nginx-1.2 series since the relevant commit is not backportable
as-is?

Debian stable (wheezy) comes with nginx 1.2 and unfortunately only
security fixes are allowed.

Ubuntu might have a similar problem, although I have not checked the
applicability of the patch there (Ubuntu comes with nginx-1.4).

Thank you,
chris

_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel
Subject Author Views Posted

Re: [nginx-announce] nginx security advisory (CVE-2014-3616)

Christos Trochalakis 757 September 17, 2014 04:00AM

Re: [nginx-announce] nginx security advisory (CVE-2014-3616)

Yichun Zhang (agentzh) 324 September 17, 2014 03:58PM

Re: [nginx-announce] nginx security advisory (CVE-2014-3616)

Christos Trochalakis 370 September 18, 2014 04:16AM

Re: nginx security advisory (CVE-2014-3616)

Matt Palmer 337 September 18, 2014 05:20AM

Re: nginx security advisory (CVE-2014-3616)

Maxim Dounin 458 September 18, 2014 06:56AM



Sorry, you do not have permission to post/reply in this forum.

Online Users

Guests: 141
Record Number of Users: 8 on April 13, 2023
Record Number of Guests: 500 on July 15, 2024
Powered by nginx      Powered by FreeBSD      PHP Powered      Powered by MariaDB      ipv6 ready