Bugzilla – Bug 897029
VUL-0: nginx,nginx-1.0: CVE-2014-3616 nginx: virtual host confusion
Last modified: 2014-12-15 10:29:05 UTC
rh#1142573 Antoine Delignat-Lavaud and Karthikeyan Bhargavan discovered a virtual host confusion issue in nginx, allowing HTTPS connections for one origin to be redirected to the virtual host of a different origin. This leads to a variety of issues, such as cookie theft and session hijacking. It could be triggered from a cross-site scripting flaw, tricking a user into visiting a malicious URL, and so on. The upstream changelog describes the issue as: "" it was possible to reuse SSL sessions in unrelated contexts if a shared SSL session cache or the same TLS session ticket key was used for multiple "server" blocks "" Full details and some mitigation strategies are available in their paper: http://bh.ht.vc/vhost_confusion.pdf It is reported that this issue affected nginx versions 0.5.6 to 1.7.4, and has been fixed in the 1.6.2 and 1.7.5 releases: http://mailman.nginx.org/pipermail/nginx-announce/2014/000147.html Upstream patch: http://trac.nginx.org/nginx/changeset/5841/nginx External References: http://bh.ht.vc/vhost_confusion.pdf References: https://bugzilla.redhat.com/show_bug.cgi?id=1142573 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3616 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3616
bugbot adjusting priority
An update workflow for this issue was started. This issue was rated as moderate. Please submit fixed packages until 2014-10-06. When done, reassign the bug to security-team@suse.de. https://swamp.suse.de/webswamp/wf/59015
Affected packages: SLE-11-SP3: nginx-1.0 SLE-11-SP3-PRODUCTS: nginx-1.0 SLE-11-SP3-UPTU: nginx-1.0
I have added the patch and has made a SR: Submitting package nginx-1.0 created request id 45013
Assigned to security-team@suse.de
SUSE-SU-2014:1286-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 897029 CVE References: CVE-2014-3616 Sources used: WebYaST 1.3 (src): nginx-1.0-1.0.15-0.10.1 SUSE Studio Onsite 1.3 (src): nginx-1.0-1.0.15-0.10.1 SUSE Lifecycle Management Server 1.3 (src): nginx-1.0-1.0.15-0.10.1
Warning, the patch has a bug that makes webyast crash, see bug 901519. Interestingly, in a testing VM, `rcwebyast start` crashes but plain `rcnginx start` does not crash.
fix released.