Vulnerabilities

TI-2008-00527 CVE-2008-0555 · GHSA-7843-hchm-wf25

The ExpandCert function in Apache-SSL before apache_1.3.41+ssl_1.59 does not properly…

LOW 37

The ExpandCert function in Apache-SSL before apache_1.3.41+ssl_1.59 does not properly handle (1) '/' and (2) '=' characters in a Distinguished Name (DN) in a client certificate, which might allow remote attackers to bypa…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.0187 Published 2008-04-04 No fix listed CWE-20

TI-2004-00009 CVE-2004-0009 · GHSA-76rg-wcxr-453v

Apache-SSL 1.3.28+1.52 and earlier, with SSLVerifyClient set to 1 or 3 and…

LOW 35

Apache-SSL 1.3.28+1.52 and earlier, with SSLVerifyClient set to 1 or 3 and SSLFakeBasicAuth enabled, allows remote attackers to forge a client certificate by using basic authentication with the "one-line DN" of the targe…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01166 Published 2004-09-01 No fix listed

TI-2002-00078 CVE-2002-0082 · GHSA-4fj5-x3ch-mc34

The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before…

MEDIUM 56

The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before 1.3.22+1.46, does not properly initialize memory using the i2d_SSL_SESSION function, which allows remote attackers to use a buffer…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.29662 Published 2002-06-25 Fixed

Vulnerabilities

Filters

The ExpandCert function in Apache-SSL before apache_1.3.41+ssl_1.59 does not properly…

Apache-SSL 1.3.28+1.52 and earlier, with SSLVerifyClient set to 1 or 3 and…

The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before…