PT-2014-5421 · Nginx+2 · Nginx+2

Antoine Delignat-Lavaud + 1 · Published 2014-09-17 · Updated 2024-06-15 · CVE-2014-3616

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions nginx versions 0.5.6 through 1.7.4

Description The issue allows remote attackers with certain privileges to conduct virtual host confusion attacks by reusing a cached SSL session for an unrelated context when the same shared ssl session cache or ssl session ticket key is used for multiple servers.

Recommendations For versions 0.5.6 through 1.7.4, consider using unique ssl session cache or ssl session ticket key for each server to prevent the reuse of cached SSL sessions across different contexts.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

ALT-PU-2014-2153

CVE-2014-3616

DLA-55-1

DSA-3029-1

MGASA-2014-0427

OPENSUSE-SU-2024:10044-1

USN-2351-1

Affected Products

Alt Linux

Nginx

Ubuntu

References · 33

• https://osv.dev/vulnerability/UBUNTU-CVE-2014-3616 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-3616 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10044-1 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2014-2153 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-3616 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-3616 · Security Note
• https://advisories.mageia.org/MGASA-2014-0427.html · Security Note
• https://osv.dev/vulnerability/MGASA-2014-0427 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-3616 · Vendor Advisory
• https://osv.dev/vulnerability/USN-2351-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3616 · Security Note
• http://mailman.nginx.org/pipermail/nginx-announce/2014/000147.html · Vendor Advisory
• https://debian.org/security/2014/dsa-3029 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-3616 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-3616 · Vendor Advisory