CVE-2005-2700: Critical severity Apache HTTP Server vulnerability
sslenginekernel.c in modssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2005-2700?
The severity of CVE-2005-2700 is considered moderate, as it allows remote attackers to bypass access restrictions.
How do I fix CVE-2005-2700?
To fix CVE-2005-2700, ensure that 'SSLVerifyClient require' is properly enforced in all relevant location contexts within your configuration.
Which versions of Apache HTTP Server are affected by CVE-2005-2700?
CVE-2005-2700 affects mod_ssl versions before 2.8.24 for Apache HTTP Server versions between 2.0.35 and 2.0.55.
Does CVE-2005-2700 affect Debian Linux?
Yes, CVE-2005-2700 affects Debian Linux versions 3.0 and 3.1 that are using the vulnerable mod_ssl.
What access issues are caused by CVE-2005-2700?
CVE-2005-2700 allows unauthorized users to access resources intended to be restricted, leading to potential security breaches.