Description
Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is off and wildcard DNS is enabled, allows remote attackers to execute script as other web site visitors, via the server name in an HTTPS response on the SSL port, which is used in a self-referencing URL, a different vulnerability than CAN-2002-0840.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | libapache-mod-ssl | 2.8.9-2.1 | DSA-181 |
Advisories 1
- DSA-181 libapache-mod-ssl - cross site scripting Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20021026 GLSA: mod_ssl mailing-list
- RHSA-2002:243 vendor-advisory
- 6029 vdb-entry
- RHSA-2002:222 vendor-advisory
- RHSA-2003:106 vendor-advisory
- RHSA-2002:251 vendor-advisory
- DSA-181 vendor-advisory
- 2107 vdb-entry
- ESA-20021029-027 vendor-advisory
- apache-modssl-host-xss(10457) vdb-entry
- MDKSA-2002:072 vendor-advisory
- 20021023 [OpenPKG-SA-2002.010] OpenPKG Security Advisory (apache) mailing-list
- CLA-2002:541 vendor-advisory
- RHSA-2002:248 vendor-advisory
- RHSA-2002:244 vendor-advisory