CVE-2011-4968: Input Validation
First published: Tue Nov 19 2019(Updated: )
nginx http proxy module does not verify peer identity of https origin server which could facilitate man-in-the-middle attack (MITM)
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| F5 Nginx | =0.7.65 | |
| F5 Nginx | =0.7.66 | |
| F5 Nginx | =0.7.64 | |
| F5 Nginx | =0.7.61 | |
| F5 Nginx | =0.7.62 | |
| F5 Nginx | =0.8.33 | |
| F5 Nginx | =0.8.40 | |
| F5 Nginx | =0.8.35 | |
| F5 Nginx | =0.8.36 | |
| F5 Nginx | =1.2.6 | |
| Debian Debian Linux | =8.0 | |
| debian/nginx | 1.14.2-2+deb10u4 1.14.2-2+deb10u5 1.18.0-6.1+deb11u3 1.22.1-9 1.24.0-2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-4968
- https://access.redhat.com/security/cve/cve-2011-4968
- https://bugzilla.suse.com/show_bug.cgi?id=CVE-2011-4968
- http://www.securityfocus.com/bid/57139
- https://exchange.xforce.ibmcloud.com/vulnerabilities/80952
- https://security-tracker.debian.org/tracker/CVE-2011-4968
- http://www.openwall.com/lists/oss-security/2013/01/03/8
- http://trac.nginx.org/nginx/ticket/13
- http://trac.nginx.org/nginx/changeset/060c2e692b96a150b584b8e30d596be1f2defa9c/nginx
Frequently Asked Questions
What is CVE-2011-4968?
CVE-2011-4968 refers to a vulnerability in the nginx http proxy module that allows a man-in-the-middle attack due to lack of peer identity verification.
What is the severity of CVE-2011-4968?
CVE-2011-4968 has a severity level of medium.
Which software is affected by CVE-2011-4968?
The nginx package versions 1.14.2-2+deb10u4, 1.14.2-2+deb10u5, 1.18.0-6.1+deb11u3, and 1.22.1-9 on Debian, as well as various versions of F5 Nginx, are affected by CVE-2011-4968.
How can I fix CVE-2011-4968?
To fix CVE-2011-4968, update the affected nginx package to version 1.14.2-2+deb10u4, 1.14.2-2+deb10u5, 1.18.0-6.1+deb11u3, or 1.22.1-9, depending on your Debian version.
Is there any additional information about CVE-2011-4968?
You can find additional information about CVE-2011-4968 in the references provided: [link1](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-4968), [link2](https://access.redhat.com/security/cve/cve-2011-4968), [link3](https://bugzilla.suse.com/show_bug.cgi?id=CVE-2011-4968).
- collector/nvd-historical
- collector/nvd-index
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/security-tracker-debian
- vendor/f5
- canonical/f5 nginx
- version/f5 nginx/0.7.65
- version/f5 nginx/0.7.66
- version/f5 nginx/0.7.64
- version/f5 nginx/0.7.61
- version/f5 nginx/0.7.62
- version/f5 nginx/0.8.33
- version/f5 nginx/0.8.40
- version/f5 nginx/0.8.35
- version/f5 nginx/0.8.36
- version/f5 nginx/1.2.6
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/8.0
- package-manager/debian