CVE-2025-23419

CWE-863 — Incorrect AuthorizationCWE-287 — Improper AuthenticationCWE-613 — Insufficient Session Expiration11 documents9 sources
Severity
5.3MEDIUM
EPSS
3.8%
top 11.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
F5 Nginx Open SourceF5 Nginx PlusF5 Nginx+1 more
Timeline
PublishedFeb 5
Latest updateApr 1

Description

When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is perfo…

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Affected Packages6 packages

▶NVDf5/nginx1.11.4 — 1.26.3+1
▶CVEListV5f5/nginx_plusR17 — *
▶NVDf5/nginx_plusr28 — r32+2
▶CVEListV5f5/nginx_open_source1.11.4 — *
▶Alpinenginx< 1.26.3-r0+3

Also affects: Debian Linux 11.0

🔴Vulnerability Details

4
GHSA
GHSA-84xh-pwc6-7g4g: When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate↗2025-02-05
▶
OSV
CVE-2025-23419: When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate↗2025-02-05
▶
CVEList
TLS Session Resumption Vulnerability↗2025-02-05
▶
OSV
CVE-2025-23419: When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate↗2025-02-05
▶

📋Vendor Advisories

6
Ubuntu
nginx vulnerability↗2025-04-01
▶
Ubuntu
nginx vulnerability↗2025-02-24
▶
Microsoft
TLS Session Resumption Vulnerability↗2025-02-11
▶
Red Hat
nginx: TLS Session Resumption Vulnerability↗2025-02-05
▶
F5
CVE-2025-23419: When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumpt...↗2025-02-05
▶