USN-7285-1: nginx vulnerability

Published Feb 24, 2025
·
Updated

It was discovered that nginx incorrectly handled when multiple server blocks are configured to share the same IP address and port. An attacker could use this issue to use session resumption to bypass client certificate authentication requirements on these servers. This issue only affected Ubuntu 24.10. A buffer overflow and a null pointer deref was fixed in nginx rtmp module (#LP 1977718). This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.

Affected Software

48 affected componentsFixes available
All of the following
ubuntu/nginx<1.26.0-2ubuntu3.2
1.26.0-2ubuntu3.2
Ubuntu Ubuntu=24.10
All of the following
ubuntu/nginx-common<1.26.0-2ubuntu3.2
1.26.0-2ubuntu3.2
Ubuntu Ubuntu=24.10
All of the following
ubuntu/nginx-core<1.26.0-2ubuntu3.2
1.26.0-2ubuntu3.2
Ubuntu Ubuntu=24.10
All of the following
ubuntu/nginx-dev<1.26.0-2ubuntu3.2
1.26.0-2ubuntu3.2
Ubuntu Ubuntu=24.10
All of the following
ubuntu/nginx-doc<1.26.0-2ubuntu3.2
1.26.0-2ubuntu3.2
Ubuntu Ubuntu=24.10
All of the following
ubuntu/nginx-extras<1.26.0-2ubuntu3.2
1.26.0-2ubuntu3.2
Ubuntu Ubuntu=24.10
All of the following
ubuntu/nginx-full<1.26.0-2ubuntu3.2
1.26.0-2ubuntu3.2
Ubuntu Ubuntu=24.10
All of the following
ubuntu/nginx-light<1.26.0-2ubuntu3.2
1.26.0-2ubuntu3.2
Ubuntu Ubuntu=24.10
All of the following
ubuntu/libnginx-mod-rtmp<1.18.0-6ubuntu14.6
1.18.0-6ubuntu14.6
Ubuntu Ubuntu=22.04
All of the following
ubuntu/nginx<1.18.0-6ubuntu14.6
1.18.0-6ubuntu14.6
Ubuntu Ubuntu=22.04
All of the following
ubuntu/nginx-common<1.18.0-6ubuntu14.6
1.18.0-6ubuntu14.6
Ubuntu Ubuntu=22.04
All of the following
ubuntu/nginx-core<1.18.0-6ubuntu14.6
1.18.0-6ubuntu14.6
Ubuntu Ubuntu=22.04
All of the following
ubuntu/nginx-doc<1.18.0-6ubuntu14.6
1.18.0-6ubuntu14.6
Ubuntu Ubuntu=22.04
All of the following
ubuntu/nginx-extras<1.18.0-6ubuntu14.6
1.18.0-6ubuntu14.6
Ubuntu Ubuntu=22.04
All of the following
ubuntu/nginx-full<1.18.0-6ubuntu14.6
1.18.0-6ubuntu14.6
Ubuntu Ubuntu=22.04
All of the following
ubuntu/nginx-light<1.18.0-6ubuntu14.6
1.18.0-6ubuntu14.6
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libnginx-mod-rtmp<1.18.0-0ubuntu1.7
1.18.0-0ubuntu1.7
Ubuntu Ubuntu=20.04
All of the following
ubuntu/nginx<1.18.0-0ubuntu1.7
1.18.0-0ubuntu1.7
Ubuntu Ubuntu=20.04
All of the following
ubuntu/nginx-common<1.18.0-0ubuntu1.7
1.18.0-0ubuntu1.7
Ubuntu Ubuntu=20.04
All of the following
ubuntu/nginx-core<1.18.0-0ubuntu1.7
1.18.0-0ubuntu1.7
Ubuntu Ubuntu=20.04
All of the following
ubuntu/nginx-doc<1.18.0-0ubuntu1.7
1.18.0-0ubuntu1.7
Ubuntu Ubuntu=20.04
All of the following
ubuntu/nginx-extras<1.18.0-0ubuntu1.7
1.18.0-0ubuntu1.7
Ubuntu Ubuntu=20.04
All of the following
ubuntu/nginx-full<1.18.0-0ubuntu1.7
1.18.0-0ubuntu1.7
Ubuntu Ubuntu=20.04
All of the following
ubuntu/nginx-light<1.18.0-0ubuntu1.7
1.18.0-0ubuntu1.7
Ubuntu Ubuntu=20.04

Event History

Feb 24, 2025
Advisory Published
via Ubuntu·12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

1

What is the severity of USN-7285-1?

The severity of USN-7285-1 is considered high due to the potential for session resumption to bypass client certificate authentication.

2

How do I fix USN-7285-1?

To fix USN-7285-1, upgrade to nginx version 1.26.0-2ubuntu3.2 or higher.

3

Which versions of nginx are affected by USN-7285-1?

Versions of nginx prior to 1.26.0-2ubuntu3.2 on Ubuntu 24.10 and earlier are affected by USN-7285-1.

4

How can an attacker exploit the vulnerability in USN-7285-1?

An attacker can exploit the vulnerability in USN-7285-1 by using session resumption to bypass client certificate authentication on affected servers.

5

Is the vulnerability in USN-7285-1 remote or local?

The vulnerability described in USN-7285-1 is considered a remote vulnerability as it can be exploited over the network.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203