apache information disclosure if modssl=yes

Package(s):

apache

CVE #(s):

CAN-2005-2700

Created:

September 2, 2005

Updated:

November 10, 2005

Description:

An information disclosure vulnerability was discovered in mod_ssl, the SSL/TLS module of the Apache webserver. When "SSLVerifyClient optional" was configured in the global virtual host configuration, an "SSLVerifyClient require" in per-location context was not enforced.

Alerts:

Fedora-Legacy	FLSA:166941	httpd	2005-11-09
Gentoo	200509-12	mod_ssl	2005-09-19
SuSE	SUSE-SA:2005:052	apache2	2005-09-12
Red Hat	RHSA-2005:773-01	mod_ssl	2005-09-15
Slackware	SSA:2005-251-03	multi	2005-09-14
Debian	DSA-807-1	libapache-mod-ssl	2005-09-12
Slackware	SSA:2005-251-02	mod_ssl	2005-09-09
Fedora	FEDORA-2005-849	httpd	2005-09-07
Mandriva	MDKSA-2005:161	apache2	2005-09-08
Fedora	FEDORA-2005-848	httpd	2005-09-07
Debian	DSA-805-1	apache2	2005-09-08
Ubuntu	USN-177-1	apache2, libapache-mod-ssl	2005-09-07
Red Hat	RHSA-2005:608-01	httpd	2005-09-06
OpenPKG	OpenPKG-SA-2005.017	apache/modssl (apache::with_mod_ssl=yes only)	2005-09-02