Description
Format string vulnerability in the mod_proxy hook functions function in ssl_engine_log.c in mod_ssl before 2.8.19 for Apache before 1.3.31 may allow remote attackers to execute arbitrary messages via format string specifiers in certain log messages for HTTPS that are handled by the ssl_log function.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | libapache-mod-ssl | 2.8.9-2.4 | DSA-532 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Network Proxy 4 | jabberd | 2.0s10-3.37.rhn | RHSA-2008:0523 |
| Red Hat Network Proxy 4 | rhn-apache | 1.3.27-36.rhn.rhel3 | RHSA-2008:0523 |
| Red Hat Network Proxy 4 | rhn-modperl | 1.29-16.rhel3 | RHSA-2008:0523 |
Advisories 2
- RHSA-2008:0523 Red Hat Security Advisory: Red Hat Network Proxy Server security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-532 libapache-mod-ssl - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://virulent.siyahsapka.org/
- 7929 vdb-entry
- USN-177-1 vendor-advisory
- 10736 vdb-entry
- RHSA-2004:405 vendor-advisory
- apache-modssl-format-string(16705) vdb-entry
- http://packetstormsecurity.org/0407-advisories/modsslFormat.txt
- CLA-2004:857 vendor-advisory
- MDKSA-2004:075 vendor-advisory
- DSA-532 vendor-advisory
- RHSA-2004:408 vendor-advisory
- FLSA:1888 vendor-advisory
- [apache-modssl] 20040716 [ANNOUNCE] mod_ssl 2.8.19 for Apache 1.3.31 mailing-list
- VU#303448 third-party-advisory
- 20040716 [OpenPKG-SA-2004.032] OpenPKG Security Advisory (apache) mailing-list