Alerts This Week
Warning Icon 1 560
Alerts This Week
Warning Icon 1 560

Fedora 41: 2025-66ebd291f8 moderate: TLS session resumption issue

fedora
Calendar Grey February 15, 2025
Dist Fedora Esm H88
Fedora 41 has released a critical update for the Nginx ModSecurity module, addressing a vulnerability in TLS session resumption that poses serious risks
Changes with nginx 1.26.3 05 Feb 2025 *) Security: insufficient check in virtual servers handling with TLSv1.3 SNI allowed to reuse SSL sessions in a different...

Summary

The ModSecurity-nginx connector is the connection point between nginx and

libmodsecurity (ModSecurity v3). Said another way, this project provides a

communication channel between nginx and libmodsecurity. This connector is

required to use LibModSecurity with nginx.

The ModSecurity-nginx connector takes the form of an nginx module. The module

simply serves as a layer of communication between nginx and ModSecurity

Update Information:

Changes with nginx 1.26.3 05 Feb 2025 *) Security: insufficient check in virtual servers handling with TLSv1.3 SNI allowed to reuse SSL sessions in a different virtual server, to bypass client SSL certificates verification (CVE-2025-23419). *) Bugfix: in the ngx_http_mp4_module. Thanks to Nils Bars. *) Workaround: "gzip filter failed to use preallocated memory" alerts appeared in logs when using zlib-ng. *) Bugfix: nginx could not build libatomic library using the library sources if the --with-libatomic=DIR option was used. *) Bugfix: nginx now ignores QUIC version negotiation packets from clients. *) Bugfix: nginx could not be built on Solaris 10 and earlier with the ngx_http_v3_module. *) Bugfixes in HTTP/3.

Topics%20covered

Topics Covered

security advisory security issue update Fedora moderate severity nginx TLS modsecurity session resumption TLS session resumption

Change Log

* Thu Feb 6 2025 Felix Kaechele - 1.0.3-16 - Rebuild for nginx 1.26.3 * Fri Jan 17 2025 Fedora Release Engineering - 1.0.3-15 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild * Mon Aug 26 2024 Felix Kaechele - 1.0.3-14 - Rebuild for nginx 1.26.2... again.

References


[ 1 ] Bug #2277663 - please switch to using systemd-sysusers to create the nginx user https://bugzilla.redhat.com/show_bug.cgi?id=2277663 [ 2 ] Bug #2344198 - CVE-2025-23419 nginx: TLS Session Resumption Vulnerability [fedora-41] https://bugzilla.redhat.com/show_bug.cgi?id=2344198

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-66ebd291f8' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

Name: nginx-mod-modsecurity
Product: Fedora 41
Version: 1.0.3
Release: 16.fc41
URL: https://github.com/owasp-modsecurity/ModSecurity-nginx
Summary: ModSecurity v3 nginx connector

Topics%20covered

Topics Covered

security advisory security issue update Fedora moderate severity nginx TLS modsecurity session resumption TLS session resumption

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here