F5-K000162606: Medium severity F5 NGINX Plus vulnerability
When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared:<name>:<size> without an explicit sslsessionticketkey file directive to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 37.0.5.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.31.71.30.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.24.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.16.05.14.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.11.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.8.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.7.0 - Configuration
Configure an explicit ssl_session_ticket_key file directive when using ssl_session_cache shared:<name>:<size> so SSL session ticket keys rotate automatically.
NGINX Plus or NGINX Open Source ssl_session_ticket_key = explicit file directive