Description
ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | httpd +3 | 2.0.52-12.2.ent | RHSA-2005:608 |
| RHEL 4 | mod_ssl | 1:2.0.52-12.2.ent | RHSA-2005:608 |
| RHEL 3 | httpd +1 | 2.0.46-46.3.ent | RHSA-2005:608 |
| RHEL 3 | mod_ssl | 1:2.0.46-46.3.ent | RHSA-2005:608 |
Advisories 3
- RHSA-2005:608 Red Hat Security Advisory: httpd security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-805-1 apache2 - several Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-807-1 libapache-mod-ssl - acl restriction bypass Debian Security (DSA / DLA) · Mar 9, 2026
References
- 16705 third-party-advisory
- DSA-807 vendor-advisory
- SSRT051043 vendor-advisory
- RHSA-2005:608 vendor-advisory
- 16700 third-party-advisory
- 17813 third-party-advisory
- 16743 third-party-advisory
- 16753 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-081.htm
- ADV-2005-2659 vdb-entry
- 17088 third-party-advisory
- TSLSA-2005-0059 vendor-advisory
- 22523 third-party-advisory
- SUSE-SA:2005:051 vendor-advisory
- 16748 third-party-advisory
- USN-177-1 vendor-advisory
- http://people.apache.org/~jorton/CAN-2005-2700.diff
- 16754 third-party-advisory
- MDKSA-2005:161 vendor-advisory
- oval:org.mitre.oval:def:10416 vdb-entry signature
- RHSA-2005:773 vendor-advisory
- http://www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=3117
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=167195
- SuSE-SA:2006:051 vendor-advisory
- RHSA-2005:816 vendor-advisory
- 16789 third-party-advisory
- 16714 third-party-advisory
- 16769 third-party-advisory
- ADV-2006-4207 vdb-entry
- 17288 third-party-advisory
- 16956 third-party-advisory
- 19072 third-party-advisory
- 21848 third-party-advisory
- 19188 vdb-entry
- ADV-2005-1625 vdb-entry
- 16771 third-party-advisory
- 16746 third-party-advisory
- GLSA-200509-12 vendor-advisory
- SUSE-SA:2005:052 vendor-advisory
- DSA-805 vendor-advisory
- 14721 vdb-entry
- 19073 third-party-advisory
- [apache-modssl] 20050902 [ANNOUNCE] mod_ssl 2.8.24-1.3.33 mailing-list
- VU#744929 third-party-advisory
- OpenPKG-SA-2005.017 vendor-advisory
- 16864 third-party-advisory
- 17311 third-party-advisory
- 102197 vendor-advisory
- 102198 vendor-advisory
- ADV-2006-0789 vdb-entry
- [httpd-dev] 20190804 Re: svn commit: r1856807 - /httpd/test/framework/trunk/t/security/CVE-2019-0215.t mailing-list
- [httpd-dev] 20190806 Re: svn commit: r1856807 - /httpd/test/framework/trunk/t/security/CVE-2019-0215.t mailing-list
- [httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1888194 [4/13] - /httpd/site/trunk/content/security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.ht mailing-list
- [httpd-cvs] 20210330 svn commit: r1073143 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/ mailing-list