Bug 168420

Summary:	mod_ssl - CAN-2005-2700 "SSLVerifyClient require" possibly not enforced
Product:	[Retired] Fedora Legacy	Reporter:	Michal Jaegermann <michal>
Component:	mod_ssl	Assignee:	Fedora Legacy Bugs <bugs>
Status:	CLOSED DUPLICATE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	pekkas
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2005-10-24 06:01:12 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Michal Jaegermann 2005-09-15 20:55:00 UTC

Description of problem:

This is a quote from
http://marc.theaimsgroup.com/?l=apache-modssl&m=112569517603897&w=2
which is an annoucement dated 2005-09-02:

'A subtle security bug (CAN-2005-2700) was discovered in mod_ssl where
where "SSLVerifyClient require" was not enforced in per-location context
if "SSLVerifyClient optional" was configured in the global virtual
host configuration.'

A version 2.8.12-8 showed up in RHEL updates with a fix for this bug.
At ftp://ftp.harddata.com/pub/Legacy_srpms/mod_ssl-2.8.12-8.legacy.src.rpm
there are corresponding sources which were used to rebuild fixed mod_ssl
on RH7.3 system.

This also includes fixes for some other possible problesm still present
in 2.8.12-7.legacy (see %changelog spec section for details).

Version-Release number of selected component (if applicable):
mod_ssl-2.8.12-7.legacy.src.rpm

Comment 1 Pekka Savola 2005-10-24 06:01:12 UTC

This CAN is fixed in #166941 which is in updates-testing (which is tracked under
'httpd' -- this may be confusing, but mod_ssl ceased being a separate package
around RHL8..).

*** This bug has been marked as a duplicate of 166941 ***