CVE-2005-2700
high · 10ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.
10
CVSS
30.6%
EPSS (exploit prob.)
98th
EPSS percentile
2005-09-06
Published
AV:N/AC:L/Au:N/C:C/I:C/A:C
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| apache | http_server | >= 2.0.35, < 2.0.55 |
| debian | debian_linux | 3.0 |
| debian | debian_linux | 3.1 |
| canonical | ubuntu_linux | 4.10 |
| canonical | ubuntu_linux | 5.04 |
Check a specific version with /api/v1/cve/match.
References
- http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html
- http://marc.info/?l=apache-modssl&m=112569517603897&w=2
- http://marc.info/?l=bugtraq&m=112604765028607&w=2
- http://marc.info/?l=bugtraq&m=112870296926652&w=2
- http://people.apache.org/~jorton/CAN-2005-2700.diff
- http://secunia.com/advisories/16700
- http://secunia.com/advisories/16705
- http://secunia.com/advisories/16714
- http://secunia.com/advisories/16743
- http://secunia.com/advisories/16746
- http://secunia.com/advisories/16748
- http://secunia.com/advisories/16753
- http://secunia.com/advisories/16754
- http://secunia.com/advisories/16769
- http://secunia.com/advisories/16771
- http://secunia.com/advisories/16789
- http://secunia.com/advisories/16864
- http://secunia.com/advisories/16956
- http://secunia.com/advisories/17088
- http://secunia.com/advisories/17288
- http://secunia.com/advisories/17311
- http://secunia.com/advisories/17813
- http://secunia.com/advisories/19072
- http://secunia.com/advisories/19073
- http://secunia.com/advisories/21848
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2005-2700