Alerts This Week
Warning Icon 1 727
Alerts This Week
Warning Icon 1 727

Fedora 40: FEDORA-2025-016ed44ddc critical: nginx mod-vts TLS resumption

fedora
Calendar Grey February 15, 2025
Dist Fedora Esm H88
Fedora 40 highlights significant updates for nginx-mod-vts, focusing on resolving vulnerabilities related to TLS session resumption and implementing critical bug fixes.
Changes with nginx 1.26.3 05 Feb 2025 *) Security: insufficient check in virtual servers handling with TLSv1.3 SNI allowed to reuse SSL sessions in a different...

Summary

Nginx virtual host traffic status module.

Update Information:

Changes with nginx 1.26.3 05 Feb 2025 *) Security: insufficient check in virtual servers handling with TLSv1.3 SNI allowed to reuse SSL sessions in a different virtual server, to bypass client SSL certificates verification (CVE-2025-23419). *) Bugfix: in the ngx_http_mp4_module. Thanks to Nils Bars. *) Workaround: "gzip filter failed to use preallocated memory" alerts appeared in logs when using zlib-ng. *) Bugfix: nginx could not build libatomic library using the library sources if the --with-libatomic=DIR option was used. *) Bugfix: nginx now ignores QUIC version negotiation packets from clients. *) Bugfix: nginx could not be built on Solaris 10 and earlier with the ngx_http_v3_module. *) Bugfixes in HTTP/3.

Topics%20covered

Topics Covered

security advisory security issue Fedora bug fix nginx bugfix TLS session nginx-mod-vts insufficient check traffic status

Change Log

* Thu Feb 6 2025 Felix Kaechele - 0.2.3-3 - Rebuild for nginx 1.26.3 * Fri Jan 17 2025 Fedora Release Engineering - 0.2.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild * Thu Jan 2 2025 Mikel Olasagasti Uranga - 0.2.3-1 - Update to 0.2.3 rhbz#2335121 * Mon Sep 2 2024 Miroslav Suchý - 0.2.2-11 - convert license to SPDX * Mon Aug 26 2024 Felix Kaechele - 0.2.2-10 - Rebuild for nginx 1.26.2... again.

References


[ 1 ] Bug #2277663 - please switch to using systemd-sysusers to create the nginx user https://bugzilla.redhat.com/show_bug.cgi?id=2277663 [ 2 ] Bug #2344197 - CVE-2025-23419 nginx: TLS Session Resumption Vulnerability [fedora-40] https://bugzilla.redhat.com/show_bug.cgi?id=2344197

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-016ed44ddc' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

Severity
critical
Lowest
Low
Medium
High
Critical

Name: nginx-mod-vts
Product: Fedora 40
Version: 0.2.3
Release: 3.fc40
URL: https://github.com/vozlt/nginx-module-vts
Summary: Nginx virtual host traffic status module

Topics%20covered

Topics Covered

security advisory security issue Fedora bug fix nginx bugfix TLS session nginx-mod-vts insufficient check traffic status

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here