The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the "SSLCipherSuite" directive in directory or location context, allows remo…

Description

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Advisories 4

• RHSA-2008:0523 Red Hat Security Advisory: Red Hat Network Proxy Server security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
• RHSA-2008:0524 Red Hat Security Advisory: Red Hat Network Satellite Server security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
• RHSA-2008:0261 Red Hat Security Advisory: Red Hat Network Satellite Server security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
• RHSA-2004:562 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Jun 29, 2026

References

• 11360 vdb-entry
• RHSA-2004:562 vendor-advisory
• http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm
• USN-177-1 vendor-advisory
• 20041015 [OpenPKG-SA-2004.044] OpenPKG Security Advisory (modssl) mailing-list
• RHSA-2005:816 vendor-advisory
• oval:org.mitre.oval:def:10384 vdb-entry signature
• 19072 third-party-advisory
• HPSBUX01123 vendor-advisory
• apache-sslciphersuite-restriction-bypass(17671) vdb-entry
• APPLE-SA-2005-08-15 vendor-advisory
• RHSA-2008:0261 vendor-advisory
• RHSA-2004:600 vendor-advisory
• APPLE-SA-2005-08-17 vendor-advisory
• 102198 vendor-advisory
• http://issues.apache.org/bugzilla/show_bug.cgi?id=31505
• ADV-2006-0789 vdb-entry
• http://www.apacheweek.com/features/security-20
• [httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
• [httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
• [httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
• [httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
• [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
• [httpd-cvs] 20210330 svn commit: r1073139 [3/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
• [httpd-cvs] 20210330 svn commit: r1888194 [3/13] - /httpd/site/trunk/content/security/json/ mailing-list
• [httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.ht mailing-list
• [httpd-cvs] 20210330 svn commit: r1073143 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/ mailing-list
• [httpd-cvs] 20210330 svn commit: r1073149 [4/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
• [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
• [httpd-cvs] 20210606 svn commit: r1075470 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabiliti mailing-list