Red Hat Security AdvisoryRHSA-2025:7331
nginx security update
Released 2025-05-13 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) nginx-2:1.20.1-22.el9, nginx-all-modules-2:1.20.1-22.el9, nginx-core-2:1.20.1-22.el9 +6
- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) nginx-mod-devel-2:1.20.1-22.el9
Fixes 1 record
Priority LOW 29
When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.02795 · Published 2025-02-05 · Partial fix CWE-863
