CVE-2014-3616

nginx could be made to expose sensitive information over the network ...

Antoine Delignat-Lavaud and Karthikeyan Bhargavan discovered that it was possible to reuse cached SSL sessions in unrelated contexts, allowing virtual host confusion attacks in some configurations by an attacker in a privileged network position For the stable distribution (wheezy), this problem has been fixed in version 121-22+wheezy3 For the ...

Debian Bug report logs - #812806 nginx: resolver CVEs: CVE-2016-0742 CVE-2016-0746 CVE-2016-0747 Package: src:nginx; Maintainer for src:nginx is Debian Nginx Maintainers <pkg-nginx-maintainers@alioth-listsdebiannet>; Reported by: Christos Trochalakis <yatiohi@ideopolisgr> Date: Tue, 26 Jan 2016 18:03:01 UTC Severi ...

Debian Bug report logs - #761940 nginx:CVE-2014-3616: possible to reuse cached SSL sessions in unrelated contexts Package: src:nginx; Maintainer for src:nginx is Debian Nginx Maintainers <pkg-nginx-maintainers@alioth-listsdebiannet>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 17 Sep 2014 05:09: ...

A virtual host confusion issue was found in nginx, allowing HTTPS connections for one origin to be redirected to the virtual host of a different origin This leads to a variety of issues, such as cookie theft and session hijacking It could be triggered from a cross-site scripting flaw, tricking a user into visiting a malicious URL, and so on ...