Apache Httpd < 2.0.47 : mod_ssl renegotiation issue

2003-04-3000:00:00

Apache Team Foundation

httpd.apache.org

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

0.012 Low

EPSS

Percentile

84.9%

JSON

A bug in the optional renegotiation code in mod_ssl included with Apache httpd can cause cipher suite restrictions to be ignored. This is triggered if optional renegotiation is used (SSLOptions +OptRenegotiate) along with verification of client certificates and a change to the cipher suite over the renegotiation.

CPENameOperatorVersion
apache httpdeq2.0.46
apache httpdeq2.0.45
apache httpdeq2.0.44
apache httpdeq2.0.43
apache httpdeq2.0.42
apache httpdeq2.0.40
apache httpdeq2.0.39
apache httpdeq2.0.37
apache httpdeq2.0.36
apache httpdeq2.0.35

Name	Operator	Version
apache httpd	eq	2.0.46
apache httpd	eq	2.0.45
apache httpd	eq	2.0.44
apache httpd	eq	2.0.43
apache httpd	eq	2.0.42
apache httpd	eq	2.0.40
apache httpd	eq	2.0.39
apache httpd	eq	2.0.37
apache httpd	eq	2.0.36
apache httpd	eq	2.0.35