Apache Httpd < 2.0.53 : SSLCipherSuite bypass

An issue has been discovered in the mod_ssl module when configured to use the “SSLCipherSuite” directive in directory or location context. If a particular location context has been configured to require a specific set of cipher suites, then a client will be able to access that location using any cipher suite allowed by the virtual host configuration.