| Package | Affected versions | Patched versions |
|---|---|---|
| http server | ≥ 2.0.35, < 2.0.55 | 2.0.55 |
ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free