CVE-2013-4508
Fixed in a distro release EPSS 3%
lighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, which makes it easier for remote attackers to hijack sessions by inserting packets into the client-server data stream or obtain sensitive information by sniffing the network.
Products: lighttpd, debian_linux, opensuse
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | lighttpd | 1.4.33-1+nmu1 |
| Debian 13 | lighttpd | 1.4.33-1+nmu1 |
| Debian 14 | lighttpd | 1.4.33-1+nmu1 |
| Debian 6.0 | lighttpd | 1.4.28-2+squeeze1.4 |
| Debian 7 | lighttpd | 1.4.31-4+deb7u1 |
| openSUSE Tumbleweed | lighttpd | 1.4.37-1.6 |