CVE-2011-4968 nginx http proxy module does not verify peer identity of https origin server which could facilitate man-in-the-middle attack (MITM)
MediumCVSS 4.8
EPSS 4.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
nginx http proxy module does not verify peer identity of https origin server which could facilitate man-in-the-middle attack (MITM)
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/nginx(Debian:12) | < 1.9.1-1 | 1.9.1-1 |
| debian/nginx(Debian:13) | < 1.9.1-1 | 1.9.1-1 |
| debian/nginx(Debian:14) | < 1.9.1-1 | 1.9.1-1 |
| f5 nginx | = 0.7.61 | No fix listed |
| f5 nginx | = 0.7.62 | No fix listed |
| f5 nginx | = 0.7.64 | No fix listed |
| f5 nginx | = 0.7.65 | No fix listed |
| f5 nginx | = 0.7.66 | No fix listed |
| f5 nginx | = 0.8.33 | No fix listed |
| f5 nginx | = 0.8.35 | No fix listed |
| f5 nginx | = 0.8.36 | No fix listed |
| f5 nginx | = 0.8.40 | No fix listed |
| f5 nginx | = 1.2.6 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| f5 nginx | = through 1.6.2 | No fix listed |
References
- Debian Security Tracker CVE-2011-4968 third-party-advisory vendor-advisory
- www.openwall.com mailing-list patch third-party-advisory
- www.securityfocus.com third-party-advisory vdb-entry
- access.redhat.com broken-link
- bugzilla.redhat.com issue-tracking patch third-party-advisory
- bugzilla.suse.com issue-tracking third-party-advisory
- exchange.xforce.ibmcloud.com third-party-advisory vdb-entry
- bugs.debian.org issue-tracking