p PatchFirst

CVE-2013-4508

CVE-2013-4508

This page contains facts from public vulnerability sources. Check the original advisory before updating.

lighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, which makes it easier for remote attackers to hijack sessions by inserting packets into the client-server data stream or obtain sensitive information by sniffing the network.

CVSS 7.5 · High · EPSS 2.6% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • lighttpd Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.4.33-1+nmu1

    Update to 1.4.33-1+nmu1

  • lighttpd Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.4.33-1+nmu1

    Update to 1.4.33-1+nmu1

  • lighttpd Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.4.33-1+nmu1

    Update to 1.4.33-1+nmu1

Original sources

Check your server →