Apache Httpd < 2.0.47 : mod_ssl renegotiation issue

2003-04-3000:00:00

Apache Team Foundation

httpd.apache.org

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

EPSS

0.012

Percentile

85.0%

JSON

A bug in the optional renegotiation code in mod_ssl included with Apache httpd can cause cipher suite restrictions to be ignored. This is triggered if optional renegotiation is used (SSLOptions +OptRenegotiate) along with verification of client certificates and a change to the cipher suite over the renegotiation.

Affected configurations

Vulners

Node

apacheapache_httpdMatch2.0.46

apacheapache_httpdMatch2.0.45

apacheapache_httpdMatch2.0.44

apacheapache_httpdMatch2.0.43

apacheapache_httpdMatch2.0.42

apacheapache_httpdMatch2.0.40

apacheapache_httpdMatch2.0.39

apacheapache_httpdMatch2.0.37

apacheapache_httpdMatch2.0.36

apacheapache_httpdMatch2.0.35

VendorProductVersionCPE
apacheapache_httpd2.0.46cpe:2.3:a:apache:apache_httpd:2.0.46:*:*:*:*:*:*:*
apacheapache_httpd2.0.45cpe:2.3:a:apache:apache_httpd:2.0.45:*:*:*:*:*:*:*
apacheapache_httpd2.0.44cpe:2.3:a:apache:apache_httpd:2.0.44:*:*:*:*:*:*:*
apacheapache_httpd2.0.43cpe:2.3:a:apache:apache_httpd:2.0.43:*:*:*:*:*:*:*
apacheapache_httpd2.0.42cpe:2.3:a:apache:apache_httpd:2.0.42:*:*:*:*:*:*:*
apacheapache_httpd2.0.40cpe:2.3:a:apache:apache_httpd:2.0.40:*:*:*:*:*:*:*
apacheapache_httpd2.0.39cpe:2.3:a:apache:apache_httpd:2.0.39:*:*:*:*:*:*:*
apacheapache_httpd2.0.37cpe:2.3:a:apache:apache_httpd:2.0.37:*:*:*:*:*:*:*
apacheapache_httpd2.0.36cpe:2.3:a:apache:apache_httpd:2.0.36:*:*:*:*:*:*:*
apacheapache_httpd2.0.35cpe:2.3:a:apache:apache_httpd:2.0.35:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apache	apache_httpd	2.0.46	cpe:2.3:a:apache:apache_httpd:2.0.46:::::::*
apache	apache_httpd	2.0.45	cpe:2.3:a:apache:apache_httpd:2.0.45:::::::*
apache	apache_httpd	2.0.44	cpe:2.3:a:apache:apache_httpd:2.0.44:::::::*
apache	apache_httpd	2.0.43	cpe:2.3:a:apache:apache_httpd:2.0.43:::::::*
apache	apache_httpd	2.0.42	cpe:2.3:a:apache:apache_httpd:2.0.42:::::::*
apache	apache_httpd	2.0.40	cpe:2.3:a:apache:apache_httpd:2.0.40:::::::*
apache	apache_httpd	2.0.39	cpe:2.3:a:apache:apache_httpd:2.0.39:::::::*
apache	apache_httpd	2.0.37	cpe:2.3:a:apache:apache_httpd:2.0.37:::::::*
apache	apache_httpd	2.0.36	cpe:2.3:a:apache:apache_httpd:2.0.36:::::::*
apache	apache_httpd	2.0.35	cpe:2.3:a:apache:apache_httpd:2.0.35:::::::*