Updated Nginx packages have been released for Debian GNU/Linux 9 (Stretch) and 10 (Buster) Extended LTS. The first vulnerability (CVE-2024-7347) allows an attacker to terminate Nginx worker memory by sending a specially crafted mp4 file, while the second vulnerability (CVE-2024-33452) enables HTTP request smuggling via a crafted HEAD request. Furthermore, the third vulnerability (CVE-2025-23419) lets an attacker skip the need for client certificate authentication when different server blocks use the same IP address and port by taking advantage of TLS Session Tickets or the SSL session cache. These vulnerabilities affect Nginx versions 1.10.3-1+deb9u9 (Stretch) and 1.14.2-2+deb10u6 (Buster) and require an update to mitigate them.

ELA-1547-1 nginx security update

ELA-1547-1 nginx security update

Package : nginx
Version : 1.10.3-1+deb9u9 (stretch), 1.14.2-2+deb10u6 (buster)

Related CVEs :
CVE-2024-7347
CVE-2024-33452
CVE-2025-23419

Multiple vulnerabilities were found in nginx a popular webserver.

CVE-2024-7347
A vulnerability was found in the ngx_http_mp4_module,
This vulnerability might allow an attacker to over-read NGINX
worker memory resulting in its termination, using a specially crafted mp4 file.

CVE-2024-33452
A vulnerability was found in the lua-nginx-module.
This vulnerability allows a remote attacker to conduct HTTP request smuggling
via a crafted HEAD request.

CVE-2025-23419
When multiple server blocks are configured to share the same IP address and port,
an attacker can use session resumption to bypass client certificate authentication
requirements on these servers.
This vulnerability arises when TLS Session Tickets are used and/or the SSL session cache
are used in the default server and the default server is performing
client certificate authentication

ELA-1547-1 nginx security update