apache information disclosure if modssl=yes [LWN.net]

Package(s):

apache

CVE #(s):

CAN-2005-2700

Created:

September 2, 2005

Updated:

November 10, 2005

Description:

An information disclosure vulnerability was discovered in mod_ssl, the SSL/TLS module of the Apache webserver. When "SSLVerifyClient optional" was configured in the global virtual host configuration, an "SSLVerifyClient require" in per-location context was not enforced.

Alerts:

Fedora-Legacy	FLSA:166941	2005-11-09
Gentoo	200509-12	2005-09-19
SuSE	SUSE-SA:2005:052	2005-09-12
Red Hat	RHSA-2005:773-01	2005-09-15
Slackware	SSA:2005-251-03	2005-09-14
Debian	DSA-807-1	2005-09-12
Slackware	SSA:2005-251-02	2005-09-09
Fedora	FEDORA-2005-849	2005-09-07
Mandriva	MDKSA-2005:161	2005-09-08
Fedora	FEDORA-2005-848	2005-09-07
Debian	DSA-805-1	2005-09-08
Ubuntu	USN-177-1	2005-09-07
Red Hat	RHSA-2005:608-01	2005-09-06
OpenPKG	OpenPKG-SA-2005.017	2005-09-02

(Log in to post comments)