[SECURITY] [DLA 4091-1] nginx security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4091-1 [email protected] https://www.debian.org/lts/security/ Andrej Shadura March 25, 2025 https://wiki.debian.org/LTS -...

ROS-20250307-10

Vulnerability in nginx software is related to TLS session resumption when processing client certificate client certificate authentication. Exploitation of the vulnerability could allow an attacker acting remotely, an attacker could bypass the authentication process...

Linux Distros Unpatched Vulnerability : CVE-2025-23419

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate...

Linux Distros Unpatched Vulnerability : CVE-2022-38152

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in wolfSSL before 5.5.0. When a TLS 1.3 client connects to a wolfSSL server and SSLclear is called on its session, the server crashes wi...

Linux Distros Unpatched Vulnerability : CVE-2016-5419

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended...

Amazon Linux 2023 : nginx, nginx-all-modules, nginx-core (ALAS2023-2025-842)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-842 advisory. When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This...

Ubuntu: Security Advisory (USN-7285-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-7285-1: nginx vulnerability

It was discovered that nginx incorrectly handled when multiple server blocks are configured to share the same IP address and port. An attacker could use this issue to use session resumption to bypass client certificate authentication requirements on these servers. This issue only affected Ubuntu...

Medium: nginx

Issue Overview: When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets...

Medium: nginx

Issue Overview: When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets...

Azure Linux 3.0 Security Update: nginx (CVE-2025-23419)

The version of nginx installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-23419 advisory. - When multiple server blocks are configured to share the same IP address and port, an attacker can use session...

TLS Session Resumption Vulnerability

...

CBL Mariner 2.0 Security Update: nginx (CVE-2025-23419)

The version of nginx installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-23419 advisory. - When multiple server blocks are configured to share the same IP address and port, an attacker can use session...

OESA-2025-1134 nginx security update

NGINX is a free, open-source, high-performance HTTP server and reverse proxy, as well as an IMAP/POP3 proxy server. Security Fixes: When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication...

SUSE CVE-2025-23419

When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets...

MGASA-2025-0051 Updated nginx packages fix security vulnerability

TLS Session Resumption Vulnerability. CVE-2025-23419...

Authentication Bypass

NGINX is vulnerable to Authentication Bypass. The vulnerability is due to shared TLS session states due to the use of TLS Session Tickets and/or the SSL session cache in the default server, which performs client certificate authentication. Attackers can use session resumption to bypass...

CVE-2025-23419

A flaw was found in nginx. When name-based virtual hosts are configured to share the same IP address and port combination with TLS 1.3 and OpenSSL, a previously authenticated attacker can use session resumption to bypass client certificate authentication requirements on these servers. This...

BIT-NGINX-2025-23419 TLS Session Resumption Vulnerability

When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets...

Internet Bug Bounty: TLS client authentication can be bypassed due to ticket resumption

The TLS client authentication can be bypassed due to ticket resumption. The issue was that TLS session tickets were not properly isolated for multiple virtual hosts in one server. This allowed a ticket issued for one virtual host to be resumed at a different virtual host, circumventing client...