[ GLSA 201502-06 ] nginx

[GLSA]

Gentoo Linux Security Advisory

Title: nginx: Information disclosure (GLSA 201502-06)
Severity: normal
Exploitable: remote
Date: February 07, 2015
Bug(s): #522994
ID: 201502-06

Synopsis

An SSL session fixation vulnerability in nginx may allow remote
attackers to obtain sensitive information.


Background

nginx is a robust, small, and high performance HTTP and reverse proxy
server.


Affected Packages

Package: www-servers/nginx
Vulnerable: < 1.7.6
Unaffected: >= 1.7.6
Architectures: All supported architectures


Description

An SSL session fixation vulnerability has been found in nginx when
multiple servers use the same shared ssl_session_cache or
ssl_session_ticket_key.


Impact

A remote attacker may be able to obtain sensitive information.

Workaround

There is no known workaround at this time.

Resolution

All nginx users should upgrade to the latest version: