CVE-2025-23419 was announced here: https://www.openwall.com/lists/oss-security/2025/02/05/8 Fix: https://github.com/nginx/nginx/commit/13935cf9fdc3c8d8278c70716417d3b71c36140e (release-1.26.3)
Source RPM: (none) => nginx-1.26.2-3.mga10.src.rpm, nginx-1.26.2-1.mga9.src.rpmWhiteboard: (none) => MGA9TOOCVE: (none) => CVE-2025-23419Status comment: (none) => Fixed upstream in 1.26.3 and patches available from upstream
Stig is the normal committer for this, but other packagers touch it as well. So assigning globally, CC'ing Stig; if you can do it, Stig - please do.
CC: (none) => smelrorAssignee: bugsquad => pkg-bugs
Suggested advisory: ======================== The updated package fixes a security vulnerability: TLS Session Resumption Vulnerability. (CVE-2025-23419) References: https://www.openwall.com/lists/oss-security/2025/02/05/8 ======================== Updated package in core/updates_testing: ======================== nginx-1.26.3-1.mga9 from SRPM: nginx-1.26.3-1.mga9.src.rpm
Source RPM: nginx-1.26.2-3.mga10.src.rpm, nginx-1.26.2-1.mga9.src.rpm => nginx-1.26.2-1.mga9.src.rpmWhiteboard: MGA9TOO => (none)Version: Cauldron => 9Status: NEW => ASSIGNEDAssignee: pkg-bugs => qa-bugsStatus comment: Fixed upstream in 1.26.3 and patches available from upstream => (none)
MGA9-64 PLasma Wayland on Compaq H000SB No installation issues Ref bug 33509, Test page shows OK. Welcome to nginx 1.26.3 on Mageia! OK.
Whiteboard: (none) => MGA9-64-OKCC: (none) => herman.viaene
Keywords: (none) => advisory
Validating.
Keywords: (none) => validated_updateCC: (none) => andrewsfarm, sysadmin-bugs
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2025-0051.html
Resolution: (none) => FIXEDStatus: ASSIGNED => RESOLVED