Aller au contenu
en Se connecter
4.3 Moyenne

CVE-2025-23419 When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption…

Description

When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is performing client certificate authentication.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Produits et versions touchés

Produit Versions touchées Corrigé en
NGINX Open Source 1.11 1.11.4 → dernières Pas de correctif indiqué
NGINX Plus Versions non publiées

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de NGINX Open Source

Les 35 CVE de NGINX Open Source →
CVE-2026-95101 Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module 5.3 Moyenne CVE-2026-93479 A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root… 8.1 Élevée CVE-2026-97205 NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module 8.1 Élevée CVE-2026-15176 A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive… 8.1 Élevée
Suivre cette CVE