CVE-2025-23419
Publication date 5 February 2025
Last updated 16 October 2026
Ubuntu priority
Description
When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is performing client certificate authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| nginx | 26.10 stonking |
Not affected
|
| 26.04 LTS resolute |
Not affected
|
|
| 24.04 LTS noble |
Fixed in 1.24.0-2ubuntu7.3
|
|
| 22.04 LTS jammy |
Fixed in 1.18.0-6ubuntu14.6
|
|
| 20.04 LTS focal |
Fixed in 1.18.0-0ubuntu1.7
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Needs evaluation
|
|
| 14.04 LTS trusty |
Needs evaluation
|
Severity score breakdown
CVSS version:
Base score
5.3 · Medium
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Base score
4.3 · Medium
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
Related Ubuntu Security Notices (USN)
- USN-7285-1
- nginx vulnerability
- 24 February 2025
- USN-7285-2
- nginx vulnerability
- 1 April 2025