[SECURITY] [DLA 55-1] nginx security update

2014-09-1700:11:46

lists.debian.org

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

6.2

Confidence

Low

EPSS

0.002

Percentile

61.6%

JSON

Package : nginx
Version : 0.7.67-3+squeeze4
CVE ID : CVE-2014-3616

Antoine Delignat-Lavaud discovered that it was possible to reuse SSL
sessions in unrelated contexts if a shared SSL session cache or the same TLS
session ticket key was used for multiple "server" blocks.
Attachment:
signature.asc
Description: Digital signature

OSVersionArchitecturePackageVersionFilename
Debian7i386nginx-naxsi< 1.2.1-2.2+wheezy3nginx-naxsi_1.2.1-2.2+wheezy3_i386.deb
Debian7armelnginx-full-dbg< 1.2.1-2.2+wheezy3nginx-full-dbg_1.2.1-2.2+wheezy3_armel.deb
Debian6amd64nginx< 0.7.67-3+squeeze4nginx_0.7.67-3+squeeze4_amd64.deb
Debian7kfreebsd-amd64nginx-naxsi< 1.2.1-2.2+wheezy3nginx-naxsi_1.2.1-2.2+wheezy3_kfreebsd-amd64.deb
Debian7kfreebsd-amd64nginx-extras-dbg< 1.2.1-2.2+wheezy3nginx-extras-dbg_1.2.1-2.2+wheezy3_kfreebsd-amd64.deb
Debian7armelnginx-light< 1.2.1-2.2+wheezy3nginx-light_1.2.1-2.2+wheezy3_armel.deb
Debian6amd64nginx-dbg< 0.7.67-3+squeeze4nginx-dbg_0.7.67-3+squeeze4_amd64.deb
Debian7ia64nginx-full< 1.2.1-2.2+wheezy3nginx-full_1.2.1-2.2+wheezy3_ia64.deb
Debian7ia64nginx-extras-dbg< 1.2.1-2.2+wheezy3nginx-extras-dbg_1.2.1-2.2+wheezy3_ia64.deb
Debian7s390xnginx-full< 1.2.1-2.2+wheezy3nginx-full_1.2.1-2.2+wheezy3_s390x.deb

OS	Version	Architecture	Package	Version	Filename
Debian	7	i386	nginx-naxsi	< 1.2.1-2.2+wheezy3	nginx-naxsi_1.2.1-2.2+wheezy3_i386.deb
Debian	7	armel	nginx-full-dbg	< 1.2.1-2.2+wheezy3	nginx-full-dbg_1.2.1-2.2+wheezy3_armel.deb
Debian	6	amd64	nginx	< 0.7.67-3+squeeze4	nginx_0.7.67-3+squeeze4_amd64.deb
Debian	7	kfreebsd-amd64	nginx-naxsi	< 1.2.1-2.2+wheezy3	nginx-naxsi_1.2.1-2.2+wheezy3_kfreebsd-amd64.deb
Debian	7	kfreebsd-amd64	nginx-extras-dbg	< 1.2.1-2.2+wheezy3	nginx-extras-dbg_1.2.1-2.2+wheezy3_kfreebsd-amd64.deb
Debian	7	armel	nginx-light	< 1.2.1-2.2+wheezy3	nginx-light_1.2.1-2.2+wheezy3_armel.deb
Debian	6	amd64	nginx-dbg	< 0.7.67-3+squeeze4	nginx-dbg_0.7.67-3+squeeze4_amd64.deb
Debian	7	ia64	nginx-full	< 1.2.1-2.2+wheezy3	nginx-full_1.2.1-2.2+wheezy3_ia64.deb
Debian	7	ia64	nginx-extras-dbg	< 1.2.1-2.2+wheezy3	nginx-extras-dbg_1.2.1-2.2+wheezy3_ia64.deb
Debian	7	s390x	nginx-full	< 1.2.1-2.2+wheezy3	nginx-full_1.2.1-2.2+wheezy3_s390x.deb