A flaw was found in the way NSSVerifyClient was handled when used in both server / vhost context as well as directory context (specified either via <Directory> or <Location> directive). If 'NSSVerifyClient none' was set in the server / vhost context (i.e. when server is configured to not request or require client certificate authentication on the initial connection), and client certificate authentication was expected to be required for a specific directory via 'NSSVerifyClient require' setting, modnss failed to properly require expected certificate authentication. Remote attacker able to connect to the web server using such modnss configuration and without a valid client certificate could possibly use this flaw to access content of the restricted directories.

Documentation of modnss configuration directives, including NSSVerifyClient:

https://git.fedorahosted.org/cgit/modnss.git/plain/docs/modnss.html#Directives

As modnss is derived form modssl, NSSVerifyClient is meant to be functionally equivalent to modssl's SSLVerifyClient:

http://httpd.apache.org/docs/2.2/mod/modssl.html#sslverifyclient