[GLSA-201502-06] nginx: Information disclosure

Severity Normal

Affected Packages 1

Unaffected Packages 1

CVEs 1

An SSL session fixation vulnerability in nginx may allow remote attackers to obtain sensitive information.

Background
nginx is a robust, small, and high performance HTTP and reverse proxy
server.

Description
An SSL session fixation vulnerability has been found in nginx when
multiple servers use the same shared ssl_session_cache or
ssl_session_ticket_key.

Impact
A remote attacker may be able to obtain sensitive information.

Workaround
There is no known workaround at this time.

Resolution
All nginx users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=www-servers/nginx-1.7.6"

Package	Affected Version
pkg:ebuild/www-servers/nginx?distro=gentoo	< 1.7.6

Package	Unaffected Version
pkg:ebuild/www-servers/nginx?distro=gentoo	>= 1.7.6

ID

GLSA-201502-06

Severity

normal

URL

https://security.gentoo.org/glsa/201502-06

Published

2015-02-07T00:00:00
(9 years ago)

Modified

2015-02-07T00:00:00
(9 years ago)

Rights

Gentoo Foundation, Inc.

Other Advisories

Source	# ID	Name	URL
CVE	CVE-2014-3616	CVE-2014-3616	https://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3616
Bugzilla	522994	Bugzilla #522994	https://bugs.gentoo.org/show_bug.cgi?id=522994

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform	Arch	Patch / Fix
Affected	pkg:ebuild/www-servers/nginx?distro=gentoo	www-servers	nginx	< 1.7.6	gentoo
Unaffected	pkg:ebuild/www-servers/nginx?distro=gentoo	www-servers	nginx	>= 1.7.6	gentoo

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date