On Tue, Sep 16, 2014 at 06:47:20PM +0400, Maxim Dounin wrote:
Hello!A problem with SSL session cache in nginx was identified by Antoine Delignat-Lavaud. It was possible to reuse cached SSL sessions in unrelated contexts, allowing virtual host confusion attacks in some configurations by an attacker in a privileged network position (CVE-2014-3616). The problem affects nginx 0.5.6 - 1.7.4 if the same shared ssl_session_cache and/or ssl_session_ticket_key are used for multiple server{} blocks. The problem is fixed in nginx 1.7.5, 1.6.2. Further details can be found in the paper by Antoine Delignat-Lavaud et al., available at http://bh.ht.vc/vhost_confusion.pdf.
Hello all, I am one of the debian nginx maintainers. Is it possible to provide a patch for nginx-1.2 series since the relevant commit is not backportable as-is? Debian stable (wheezy) comes with nginx 1.2 and unfortunately only security fixes are allowed. Ubuntu might have a similar problem, although I have not checked the applicability of the patch there (Ubuntu comes with nginx-1.4). Thank you, chris _______________________________________________ nginx-devel mailing list nginx-devel@nginx.org http://mailman.nginx.org/mailman/listinfo/nginx-devel
