ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Information
Published : 2005-09-06 23:03
Updated : 2021-06-06 11:15
NVD link : CVE-2005-2700
Mitre link : CVE-2005-2700
JSON object : View
Products Affected
redhat
- enterprise_linux
- enterprise_linux_desktop
apache
- http_server
mod_ssl
- mod_ssl
CWE
