p PatchFirst

ALPINE-CVE-2025-23419

ALPINE-CVE-2025-23419

This page contains facts from public vulnerability sources. Check the original advisory before updating.

When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is performing client certificate authentication.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

CVSS 5.3 · Medium · Fix available

Published
Updated

Stack: system · web

Affected products and versions

  • nginx Alpine:v3.20

    Affected ranges
    • ECOSYSTEM: ≥ 1.11.4, < 1.26.3-r0

    Update to 1.26.3-r0

  • nginx Alpine:v3.21

    Affected ranges
    • ECOSYSTEM: ≥ 1.11.4, < 1.26.3-r0

    Update to 1.26.3-r0

  • nginx Alpine:v3.22

    Affected ranges
    • ECOSYSTEM: ≥ 1.11.4, < 1.26.3-r0

    Update to 1.26.3-r0

  • nginx Alpine:v3.23

    Affected ranges
    • ECOSYSTEM: ≥ 1.11.4, < 1.26.3-r0

    Update to 1.26.3-r0

  • nginx Alpine:v3.24

    Affected ranges
    • ECOSYSTEM: ≥ 1.11.4, < 1.26.3-r0

    Update to 1.26.3-r0

Original sources

Check your server →