NVD Vulnerability Detail

CVE-2011-4968

Summary	nginx http proxy module does not verify peer identity of https origin server which could facilitate man-in-the-middle attack (MITM)
Publication Date	Nov. 20, 2019, 1:15 a.m.
Registration Date	Jan. 28, 2021, 4:40 p.m.
Last Update	Nov. 21, 2024, 10:33 a.m.

Affected software configurations

Configuration2		or higher	or less	more than	less than
cpe:2.3:o:debian:debian_linux:8.0:::::::*

Related information, measures and tools

No	URL	タグ
1	http://www.openwall.com/lists/oss-security/2013/01/03/8	Mailing List Patch Third Party Advisory
2	http://www.securityfocus.com/bid/57139	Third Party Advisory VDB Entry
3	https://access.redhat.com/security/cve/cve-2011-4968	Broken Link
4	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-4968	Issue Tracking Patch Third Party Advisory
5	https://bugzilla.suse.com/show_bug.cgi?id=CVE-2011-4968	Issue Tracking Third Party Advisory
6	https://exchange.xforce.ibmcloud.com/vulnerabilities/80952	Third Party Advisory VDB Entry
7	https://security-tracker.debian.org/tracker/CVE-2011-4968	Third Party Advisory
8	http://www.openwall.com/lists/oss-security/2013/01/03/8	Mailing List Patch Third Party Advisory
9	https://security-tracker.debian.org/tracker/CVE-2011-4968	Third Party Advisory
10	https://exchange.xforce.ibmcloud.com/vulnerabilities/80952	Third Party Advisory VDB Entry
11	https://bugzilla.suse.com/show_bug.cgi?id=CVE-2011-4968	Issue Tracking Third Party Advisory
12	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-4968	Issue Tracking Patch Third Party Advisory
13	https://access.redhat.com/security/cve/cve-2011-4968	Broken Link
14	http://www.securityfocus.com/bid/57139	Third Party Advisory VDB Entry

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html

JVN Vulnerability Information

nginx http proxy モジュールにおける入力確認に関する脆弱性

Title	nginx http proxy モジュールにおける入力確認に関する脆弱性
Summary	nginx http proxy モジュールには、入力確認に関する脆弱性が存在します。
Possible impacts	情報を取得される、および情報を改ざんされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Dec. 23, 2011, midnight
Registration Date	Dec. 4, 2019, 5:21 p.m.
Last Update	Dec. 4, 2019, 5:21 p.m.

Affected System

Debian

Debian GNU/Linux

Igor Sysoev

nginx

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2011-4968	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4968
National Vulnerability Database (NVD)
2	CVE-2011-4968	https://nvd.nist.gov/vuln/detail/CVE-2011-4968
Security Bug Tracker
3	CVE-2011-4968	https://security-tracker.debian.org/tracker/CVE-2011-4968

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
nginx
1	Top Page	http://nginx.org/

その他

No	Name	URL
関連文書
1	Bug 892030 (CVE-2011-4968) - CVE-2011-4968 nginx: http proxy module does not validate SSL certificates	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-4968
2	Re: nginx http proxy module does not verify peer identity of https origin server	https://www.openwall.com/lists/oss-security/2013/01/03/8

Change Log

No	Changed Details	Date of change
1	[2019年12月04日] 掲載	Dec. 4, 2019, 5:21 p.m.