{"id":"CVE-2014-3616","aliases":["DEBIAN-CVE-2014-3616","DLA-55-1","DSA-3029-1","EUVD-2014-3580","GHSA-ch64-2v27-7pwp","MGASA-2014-0427","UBUNTU-CVE-2014-3616","USN-2351-1","openSUSE-SU-2024:10044-1"],"status":"published","title":"nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key...","description":"nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct \"virtual host confusion\" attacks.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.05654,"percentile":0.93016,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-613"],"published":"2014-09-17T00:00:00Z","modified":"2026-10-23T15:47:24Z","fixes":[{"ecosystem":"Debian:12","package":"nginx","fixed_in":["1.6.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nginx","fixed_in":["1.6.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nginx","fixed_in":["1.6.2-1"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"nginx","fixed_in":["0.7.67-3+squeeze4"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"nginx","fixed_in":["1.2.1-2.2+wheezy3"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"nginx","fixed_in":["1.2.9-1.3.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"nginx","fixed_in":["1.4.7-1.1.mga4"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"nginx","fixed_in":["1.4.6-1ubuntu3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.67-3+squeeze4"}]}],"versions":["0.7.67-3","0.7.67-3+squeeze1","0.7.67-3+squeeze2","0.7.67-3+squeeze3"]},{"source":"osv","ecosystem":"Debian:7","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-2.2+wheezy3"}]}],"versions":["1.2.1-2.2","1.2.1-2.2+wheezy1","1.2.1-2.2+wheezy2","1.2.1-2.2+wheezy3~bpo60+1"]},{"source":"osv","ecosystem":"Mageia:3","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.9-1.3.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-1.1.mga4"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-1ubuntu3.1"}]}],"versions":["1.4.1-3ubuntu1","1.4.3-2ubuntu1","1.4.4-1ubuntu1","1.4.4-2ubuntu1","1.4.4-4ubuntu1","1.4.5-1ubuntu1","1.4.6-1ubuntu2","1.4.6-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-1ubuntu3.1"}]}],"versions":["1.4.1-3ubuntu1","1.4.3-2ubuntu1","1.4.4-1ubuntu1","1.4.4-2ubuntu1","1.4.4-4ubuntu1","1.4.5-1ubuntu1","1.4.6-1ubuntu2","1.4.6-1ubuntu3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.4-2.5"}]}],"bundled":11}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"f5","product":"nginx"}],"references":[{"url":"http://mailman.nginx.org/pipermail/nginx-announce/2014/000147.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.debian.org/security/2014/dsa-3029","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3616"},{"url":"https://github.com/advisories/GHSA-ch64-2v27-7pwp"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-3616","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0427.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14104","tags":["report"]},{"url":"https://www.debian.org/security/2014/dsa-3029","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-3616","tags":["report"]},{"url":"http://bh.ht.vc/vhost_confusion.pdf","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2351-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3616","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-2089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2070","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4450","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-3616","description":"nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct \"virtual host confusion\" attacks.","status":"published","published":"2014-12-08T11:00:00Z","modified":"2024-08-06T10:50:17.28Z","updated_at":"2026-11-02T14:33:44.23164Z"}],"euvd":[{"id":"EUVD-2014-3580","description":"nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct \"virtual host confusion\" attacks.","status":"published","published":"2014-12-08T11:00:00Z","modified":"2024-08-06T10:50:17Z","updated_at":"2026-11-03T01:57:10.446744Z"}],"ghsa":[{"id":"GHSA-ch64-2v27-7pwp","title":"nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key...","description":"nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct \"virtual host confusion\" attacks.","status":"published","published":"2022-05-13T01:05:17Z","modified":"2023-02-01T05:02:52Z","cwes":["CWE-613"],"updated_at":"2026-11-02T14:49:58.981291Z"}],"nvd":[{"id":"CVE-2014-3616","description":"nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct \"virtual host confusion\" attacks.","status":"published","published":"2014-12-08T11:59:03.39Z","modified":"2026-06-17T00:08:37.557Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T14:02:57.680258Z"}],"osv":[{"id":"CVE-2014-3616","description":"nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct \"virtual host confusion\" attacks.","status":"published","published":"2014-12-08T11:59:03Z","modified":"2026-04-16T06:15:34.692354273Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-3616","description":"nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct \"virtual host confusion\" attacks.","status":"published","published":"2014-12-08T11:59:03.39Z","modified":"2026-10-23T15:47:24.248687497Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"DLA-55-1","title":"nginx - security update","status":"published","published":"2014-09-17T00:00:00Z","modified":"2026-03-09T02:10:12.181357Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3029-1","title":"nginx - security update","status":"published","published":"2014-09-20T00:00:00Z","modified":"2026-03-09T01:22:05.486508Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0427","title":"Updated nginx packages fix CVE-2014-3616","description":"Updated nginx package fixes security vulnerability:\n\nAntoine Delignat-Lavaud and Karthikeyan Bhargavan discovered that it was\npossible to reuse cached SSL sessions in unrelated contexts, allowing virtual\nhost confusion attacks in some configurations by an attacker in a privileged\nnetwork position (CVE-2014-3616).\n","status":"published","published":"2014-10-28T11:33:36Z","modified":"2026-04-16T06:25:29.785252256Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10044-1","title":"nginx-1.11.4-2.5 on GA media","description":"These are all security issues fixed in the nginx-1.11.4-2.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:22:35.012911Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"UBUNTU-CVE-2014-3616","description":"nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct \"virtual host confusion\" attacks.","status":"published","published":"2014-09-17T00:00:00Z","modified":"2026-02-04T04:38:19.27848Z","updated_at":"2026-11-02T15:54:09.010095Z"},{"id":"USN-2351-1","title":"nginx vulnerability","description":"Antoine Delignat-Lavaud and Karthikeyan Bhargavan discovered that nginx\nincorrectly reused cached SSL sessions. An attacker could possibly use this\nissue in certain configurations to obtain access to information from a\ndifferent virtual host.\n","status":"published","published":"2014-09-22T16:32:19Z","modified":"2026-02-10T04:40:50Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}