nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct virtual host confusion attacks.
Weakness
According to WASC, “Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.”
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Nginx | F5 | 0.5.6 (including) | 1.6.2 (excluding) |
| Nginx | F5 | 1.7.0 (including) | 1.7.5 (excluding) |
| Nginx | Ubuntu | esm-infra-legacy/trusty | * |
| Nginx | Ubuntu | lucid | * |
| Nginx | Ubuntu | precise | * |
| Nginx | Ubuntu | trusty | * |
| Nginx | Ubuntu | trusty/esm | * |
| Nginx | Ubuntu | upstream | * |