CVE-2025-23419

Name
CVE-2025-23419
Description
When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is performing client certificate authentication.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
f5sirt@f5.com https://my.f5.com/manage/s/article/K000149173
af854a3a-2127-422b-91ae-364da2661108 http://www.openwall.com/lists/oss-security/2025/02/05/8
af854a3a-2127-422b-91ae-364da2661108 https://lists.debian.org/debian-lts-announce/2025/03/msg00017.html

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:* nginx >= 1.11.4 < 1.26.3
cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:* nginx >= 1.27.0 < 1.27.4
cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:* nginx_plus >= r28 < r32
cpe:2.3:a:f5:nginx_plus:r32:-:*:*:*:*:*:* nginx_plus == None == r32
cpe:2.3:a:f5:nginx_plus:r33:-:*:*:*:*:*:* nginx_plus == None == r33

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
nginx edge-main 1.26.3-r0 Jakub Jirutka <jakub@jirutka.cz> fixed
nginx edge-main 1.26.2-r4 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.26.2-r3 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.26.2-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.24.0-r12 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.22.1-r2 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.22.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.20.2-r2 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.20.2-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.20.1-r1 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.20.1-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx edge-main 1.16.1-r6 None possibly vulnerable
nginx edge-main 1.16.1-r0 None possibly vulnerable
nginx edge-main 1.14.1-r0 None possibly vulnerable
nginx edge-main 1.12.1-r0 None possibly vulnerable
nginx 3.22-main 1.26.3-r0 None fixed
nginx 3.22-main 1.26.2-r0 None possibly vulnerable
nginx 3.22-main 1.24.0-r12 None possibly vulnerable
nginx 3.22-main 1.22.1-r0 None possibly vulnerable
nginx 3.22-main 1.20.2-r2 None possibly vulnerable
nginx 3.22-main 1.20.1-r1 None possibly vulnerable
nginx 3.22-main 1.20.1-r0 None possibly vulnerable
nginx 3.22-main 1.16.1-r6 None possibly vulnerable
nginx 3.22-main 1.16.1-r0 None possibly vulnerable
nginx 3.22-main 1.14.1-r0 None possibly vulnerable
nginx 3.22-main 1.12.1-r0 None possibly vulnerable
nginx 3.21-main 1.26.3-r0 Jakub Jirutka <jakub@jirutka.cz> fixed
nginx 3.21-main 1.26.2-r4 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx 3.21-main 1.26.2-r3 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx 3.21-main 1.26.2-r0 None possibly vulnerable
nginx 3.21-main 1.24.0-r12 None possibly vulnerable
nginx 3.21-main 1.22.1-r0 None possibly vulnerable
nginx 3.21-main 1.20.2-r2 None possibly vulnerable
nginx 3.21-main 1.20.1-r1 None possibly vulnerable
nginx 3.21-main 1.20.1-r0 None possibly vulnerable
nginx 3.21-main 1.16.1-r6 None possibly vulnerable
nginx 3.21-main 1.16.1-r0 None possibly vulnerable
nginx 3.21-main 1.14.1-r0 None possibly vulnerable
nginx 3.21-main 1.12.1-r0 None possibly vulnerable
nginx 3.20-main 1.26.3-r0 Jakub Jirutka <jakub@jirutka.cz> fixed
nginx 3.20-main 1.26.2-r0 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx 3.20-main 1.24.0-r12 None possibly vulnerable
nginx 3.20-main 1.22.1-r0 None possibly vulnerable
nginx 3.20-main 1.20.2-r2 None possibly vulnerable
nginx 3.20-main 1.20.1-r1 None possibly vulnerable
nginx 3.20-main 1.20.1-r0 None possibly vulnerable
nginx 3.20-main 1.16.1-r6 None possibly vulnerable
nginx 3.20-main 1.16.1-r0 None possibly vulnerable
nginx 3.20-main 1.14.1-r0 None possibly vulnerable
nginx 3.20-main 1.12.1-r0 None possibly vulnerable
nginx 3.19-main 1.24.0-r16 Jakub Jirutka <jakub@jirutka.cz> possibly vulnerable
nginx 3.19-main 1.24.0-r12 None possibly vulnerable
nginx 3.19-main 1.22.1-r0 None possibly vulnerable
nginx 3.19-main 1.20.2-r2 None possibly vulnerable
nginx 3.19-main 1.20.1-r1 None possibly vulnerable
nginx 3.19-main 1.20.1-r0 None possibly vulnerable
nginx 3.19-main 1.16.1-r6 None possibly vulnerable
nginx 3.19-main 1.16.1-r0 None possibly vulnerable
nginx 3.19-main 1.14.1-r0 None possibly vulnerable
nginx 3.19-main 1.12.1-r0 None possibly vulnerable