CVE-2014-3616: Medium severity nginx vulnerability
nginx 0.5.6 through 1.7.4, when using the same shared sslsessioncache or sslsessionticketkey for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct "virtual host confusion" attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3616?
CVE-2014-3616 is classified as a medium severity vulnerability that can lead to virtual host confusion attacks.
How do I fix CVE-2014-3616?
To fix CVE-2014-3616, ensure that each server uses a separate ssl_session_cache and ssl_session_ticket_key.
What types of attacks can be conducted due to CVE-2014-3616?
CVE-2014-3616 allows remote attackers to conduct virtual host confusion attacks by reusing SSL sessions.
Which versions of nginx are affected by CVE-2014-3616?
nginx versions from 0.5.6 through 1.7.4 are affected by CVE-2014-3616.
Is CVE-2014-3616 relevant to any operating systems?
Yes, CVE-2014-3616 affects nginx installations running on Debian GNU/Linux versions 7.0 and 8.0.