A security vulnerability was found in the nginx package.
------
This is the email that went out in the nginx security advisories list regarding this vulnerability:
Hello!
A problem with SSL session cache in nginx was identified by Antoine
Delignat-Lavaud. It was possible to reuse cached SSL sessions in
unrelated contexts, allowing virtual host confusion attacks in some
configurations by an attacker in a privileged network position
(CVE-2014-3616).
The problem affects nginx 0.5.6 - 1.7.4 if the same shared
ssl_session_cache and/or ssl_session_ticket_key are used for multiple
server{} blocks.
A security vulnerability was found in the nginx package.
------
This is the email that went out in the nginx security advisories list regarding this vulnerability:
Hello!
A problem with SSL session cache in nginx was identified by Antoine
Delignat-Lavaud. It was possible to reuse cached SSL sessions in
unrelated contexts, allowing virtual host confusion attacks in some
configurations by an attacker in a privileged network position
(CVE-2014-3616).
The problem affects nginx 0.5.6 - 1.7.4 if the same shared ticket_ key are used for multiple
ssl_session_cache and/or ssl_session_
server{} blocks.
The problem is fixed in nginx 1.7.5, 1.6.2.
Further details can be found in the paper by Antoine Delignat-Lavaud bh.ht.vc/ vhost_confusion .pdf.
et al., available at http://
------
This is CVE-2014-3616.
------
This has been fixed upstream in nginx. This has also been fixed in Debian.
------
The Debian bug for this is: https:/ /bugs.debian. org/cgi- bin/bugreport. cgi?bug= 761940