CVE-2025-23419

Published Feb 5, 2025

Last updated 17 days ago

Overview

Description
When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is performing client certificate authentication.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Source
f5sirt@f5.com
NVD status
Received

Risk scores

CVSS 4.0

Type
Secondary
Base score
5.3
Impact score
-
Exploitability score
-
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity
MEDIUM

CVSS 3.1

Type
Secondary
Base score
4.3
Impact score
1.4
Exploitability score
2.8
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Severity
MEDIUM

Weaknesses

f5sirt@f5.com
CWE-287

Social media

Hype score
Not currently trending
  1. Nginx, Des attaquants peuvent contourner les mécanismes de Sécurité et accéder aux zones sensibles du serveur. Faille critique référencée CVE-2025-23419 de score CVSS évalué à 9.8/10. https://t.co/5SPirwUDpU #.Contournement de Politique Sécurité #.Correctif #.Faille #CERT

    @NicolasCoolman

    12 Feb 2025

    9 Impressions

    0 Retweets

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. Top 5 Trending CVEs: 1 - CVE-2024-12754 2 - CVE-2025-23369 3 - CVE-2024-46982 4 - CVE-2025-23419 5 - CVE-2025-20124 #cve #cvetrends #cveshield #cybersecurity https://t.co/4Fua3CAN6W

    @CVEShield

    10 Feb 2025

    18 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. Top 5 Trending CVEs: 1 - CVE-2025-23369 2 - CVE-2025-23419 3 - CVE-2025-21298 4 - CVE-2024-21413 5 - CVE-2013-2678 #cve #cvetrends #cveshield #cybersecurity https://t.co/4Fua3CAN6W

    @CVEShield

    9 Feb 2025

    11 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. Cloudflare quickly resolved a vulnerability in its Mutual TLS (mTLS) implementation (CVE-2025-23419) that allowed session resumption without validating certificates. Security enhanced! 🔒✨ #Cloudflare #mTLS #USA link: https://t.co/LecdCYlD3Q https://t.co/8xp5rp5Clv

    @TweetThreatNews

    8 Feb 2025

    54 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  5. nginxの脆弱性(Moderate: CVE-2025-23419) https://t.co/0DkxdrtiBn

    @matsuu_zatsu

    8 Feb 2025

    113 Impressions

    0 Retweets

    3 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  6. In 2017, @Cloudflare announced it was retiring the "Server: cloudflare-nginx" HTTP header as its infrastructure evolved beyond NGINX: https://t.co/VwyWhocUem Now, in 2025, Cloudflare was affected by an NGINX bug (CVE-2025-23419): https://t.co/6ZDxuVVfOs

    @CTF

    7 Feb 2025

    17 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  7. Cloudflare patched a Mutual TLS (mTLS) vulnerability (CVE-2025-23419) reported via our Bug Bounty Program. The issue was mitigated in 32 hours by disabling session resumption for mTLS connections. Here we have details on the background and remediation of the issue.… https://t.co/

    @Cloudflare

    7 Feb 2025

    10505 Impressions

    13 Retweets

    88 Likes

    15 Bookmarks

    1 Reply

    3 Quotes

  8. F5 warns of a critical TLS session resumption vulnerability (CVE-2025-23419) in NGINX, allowing unauthorized access by bypassing client certificate authentication. Affects versions R28-R33 & 1.11.4-1.27.31. ⚠️ #NGINX #CyberAlert #USA link: https://t.co/XQaUbDqehM https://t.c

    @TweetThreatNews

    7 Feb 2025

    19 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  9. [#KUSANAGI9 Updated!] KUSANAGI 9 Module Update KUSANAGI 9 modules have been updated. The updated modules are as follows: nginx126 1.26.3-1 This update includes support for vulnerability(CVE-2025-23419). The module... https://t.co/2SoJk7JVXd #KUSANAGI #KUSANAGI9

    @kusanagi_saya

    7 Feb 2025

    30 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  10. CVE-2025-23419 impacts Nginx Server #NginxServer #CVE-2025-23419 https://t.co/jiqZQvqNHl

    @pravin_karthik

    7 Feb 2025

    29 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  11. CVE-2025-23419: nginx: Client certificate authentication bypass with TLSv1.3 and session resumption https://t.co/dmG8Fhj5df

    @oss_security

    5 Feb 2025

    59 Impressions

    0 Retweets

    0 Likes

    1 Bookmark

    0 Replies

    0 Quotes