BSA-2017-105

🗓️ 03 Jan 2017 00:00:00Reported by Broadcom Security ResponseType

Apache HTTP Server 2.4.18–2.4.20 with mod_http2 and mod_ssl may bypass access by misreading the SSLVerifyClient require directive over HTTP/2.

Reporter	Title	Published	Views	Family All 42
IBM Security Bulletins	Security Bulletin: IBM i Integrated Web Application Server version 8.5 is affected by multiple vulnerabilities.	18 Dec 201914:26	–	ibm
Tenable Nessus	Apache HTTP Server 2.4.x < 2.4.23 Multiple Vulnerabilities	15 Jul 201600:00	–	nessus
Tenable Nessus	Apache 2.4.18 / 2.4.20 X.509 Certificate Authentication Bypass	15 Jul 201600:00	–	nessus
Tenable Nessus	Fedora 24 : httpd (2016-c7288a5b36)	15 Jul 201600:00	–	nessus
Tenable Nessus	Fedora 23 : httpd (2016-e256a03791)	18 Jul 201600:00	–	nessus
Tenable Nessus	FreeBSD : apache24 -- X509 Client certificate based authentication can be bypassed when HTTP/2 is used (e9d1e040-42c9-11e6-9608-20cf30e32f6d)	6 Jul 201600:00	–	nessus
Tenable Nessus	GLSA-201610-02 : Apache: Multiple vulnerabilities	7 Oct 201600:00	–	nessus
Tenable Nessus	MiracleLinux 4 : httpd24-httpd-2.4.18-11.AXS4 (AXSA:2016-567:01)	16 Jan 202600:00	–	nessus
Tenable Nessus	MiracleLinux 7 : httpd24-httpd-2.4.18-11.el7 (AXSA:2016-572:01)	16 Jan 202600:00	–	nessus
Tenable Nessus	Apache 2.4.18 / 2.4.20 X.509 Certificate Authentication Bypass	9 Jan 201900:00	–	nessus

07 Feb 2017 23:06Current

7.6High risk

Vulners AI Score7.6

CVSS 25

CVSS 37.5

EPSS0.1736