CVE-2014-3616

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-12-08 · updated 2026-06-17
Weakness: CWE-613

Description

nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct "virtual host confusion" attacks.

Affected products

Debian Linux: 7.0, 8.0
nginx: from 0.5.6 before 1.6.2; from 1.7.0 before 1.7.5 — fixed in 1.6.2, 1.7.5

How to fix

Upgrade to a fixed version: nginx 1.6.2, 1.7.5. Check the vendor advisory for mitigations.

References

http://mailman.nginx.org/pipermail/nginx-announce/2014/000147.html
http://www.debian.org/security/2014/dsa-3029
http://mailman.nginx.org/pipermail/nginx-announce/2014/000147.html
http://www.debian.org/security/2014/dsa-3029

Get alerted when CVE-2014-3616 or the next vulnerability affects your stack