CVE-2014-3616

Name of the Vulnerable Software and Affected Versions nginx versions 0.5.6 through 1.7.4

Description The issue allows remote attackers with certain privileges to conduct virtual host confusion attacks by reusing a cached SSL session for an unrelated context when the same shared ssl session cache or ssl session ticket key is used for multiple servers.

Recommendations For versions 0.5.6 through 1.7.4, consider using unique ssl session cache or ssl session ticket key for each server to prevent the reuse of cached SSL sessions across different contexts.