Authentication Bypass

🗓️ 09 Feb 2025 18:00:50Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 4 Views

NGINX vulnerability allows authentication bypass using shared TLS session states via session resumption.

Reporter	Title	Published	Views	Family All 112
IBM Security Bulletins	Security Bulletin: Vulnerability in nginx affects IBM Netezza Appliance	24 Dec 202509:18	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities exists in IBM Netezza Performance Server Replication Services	27 Feb 202619:55	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerability in nginx affects IBM Robotic Process Automation for Cloud Pak	23 Mar 202613:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component was using python,nginx and packages which were vulnerable to CVE-2025-4435, CVE-2025-23419, CVE-2025-4330, CVE-2025-4138, CVE-2025-47273	6 Feb 202606:19	–	ibm
FreeBSD	nginx-devel -- SSL session reuse vulnerability	5 Feb 202500:00	–	freebsd
Tenable Nessus	Amazon Linux 2023 : nginx, nginx-all-modules, nginx-core (ALAS2023-2025-842)	26 Feb 202500:00	–	nessus
Tenable Nessus	Amazon Linux 2 : nginx (ALASNGINX1-2025-008)	28 Mar 202500:00	–	nessus
Tenable Nessus	Azure Linux 3.0 Security Update: nginx (CVE-2025-23419)	21 Feb 202500:00	–	nessus
Tenable Nessus	Debian dla-4091 : libnginx-mod-http-auth-pam - security update	25 Mar 202500:00	–	nessus
Tenable Nessus	Fedora 40 : nginx / nginx-mod-fancyindex / nginx-mod-modsecurity / etc (2025-016ed44ddc)	15 Feb 202500:00	–	nessus

Vulners

Node

nginx nginxMatch1.18.0-6debian

AND

debian debian_linuxMatch999

nginx nginxMatch1.22.1-r0os

AND

nginx nginxMatch1.16.1-r8os

AND

nginx nginxMatch1.20.1-r4os

AND

nginx nginxMatch1.20.2-r1os

AND

nginx nginxMatch1.26.1-r2os

AND

nginx nginxMatch1.24.0-r10os

AND

nginx nginxMatch1.24.0-r17os

AND

nginx nginxMatch1.22.0-r0os

AND

nginx nginxMatch1.24.0-r6os

AND

nginx nginxMatch1.20.1-r1os

AND

nginx nginxMatch1.26.0-r1os

AND

nginx nginxMatch1.22.0-r8os

AND

nginx nginxMatch1.24.0-r2os

AND

nginx nginxMatch1.24.0-r0os

AND

nginx nginxMatch1.24.0-r13os

AND

nginx nginxMatch1.22.0-r1os

AND

nginx nginxMatch1.20.1-r3os

AND

nginx nginxMatch1.26.2-r2os

AND

nginx nginxMatch1.24.0-r18os

AND

nginx nginxMatch1.20.2-r0os

AND

nginx nginxMatch1.22.0-r7os

AND

nginx nginxMatch1.26.2-r3os

AND

nginx nginxMatch1.26.2-r0os

AND

nginx nginxMatch1.20.1-r6os

AND

nginx nginxMatch1.26.0-r2os

AND

nginx nginxMatch1.24.0-r9os

AND

nginx nginxMatch1.20.1-r12os

AND

nginx nginxMatch1.24.0-r14os

AND

nginx nginxMatch1.26.0-r0os

AND

nginx nginxMatch1.24.0-r1os

AND

nginx nginxMatch1.22.0-r5os

AND

nginx nginxMatch1.22.0-r3os

AND

nginx nginxMatch1.20.1-r5os

AND

nginx nginxMatch1.20.1-r7os

AND

nginx nginxMatch1.18.0-r0os

AND

nginx nginxMatch1.24.0-r12os

AND

nginx nginxMatch1.20.1-r9os

AND

nginx nginxMatch1.20.1-r13os

AND

nginx nginxMatch1.26.2-r4os

AND

nginx nginxMatch1.18.0-r15os

AND

nginx nginxMatch1.20.2-r2os

AND

nginx nginxMatch1.18.0-r14os

AND

nginx nginxMatch1.20.0-r0os

AND

nginx nginxMatch1.26.1-r3os

AND

nginx nginxMatch1.20.1-r0os

AND

nginx nginxMatch1.24.0-r16os

AND

nginx nginxMatch1.26.1-r0os

AND

nginx nginxMatch1.20.1-r2os

AND

nginx nginxMatch1.22.0-r6os

AND

nginx nginxMatch1.24.0-r11os

AND

nginx nginxMatch1.22.0-r2os

AND

alpinelinux alpine_linuxMatchedge

nginx nginxMatch1.26.0-r0os

AND

nginx nginxMatch1.26.2-r0os

AND

nginx nginxMatch1.26.0-r2os

AND

nginx nginxMatch1.26.0-r1os

AND

nginx nginxMatch1.26.1-r0os

AND

alpinelinux alpine_linuxMatch3.20

nginx nginxMatch1.26.2-r0os

AND

nginx nginxMatch1.26.2-r3os

AND

nginx nginxMatch1.26.2-r2os

AND

nginx nginxMatch1.26.2-r4os

AND

nginx nginxMatch1.26.2-r1os

AND

alpinelinux alpine_linuxMatch3.21

nginx nginxMatch1.18.0-6debian

AND

debian debian_linuxMatch11

Source	Link
lists	www.lists.debian.org/debian-lts-announce/2025/03/msg00017.html
security-tracker	www.security-tracker.debian.org/tracker/CVE-2025-23419
my	www.my.f5.com/manage/s/article/K000149173
openwall	www.openwall.com/lists/oss-security/2025/02/05/8

27 Jan 2026 15:17Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.14.3

CVSS 45.3

EPSS0.02857

SSVC