diff options
| author | Joe Orton <jorton@apache.org> | 2005-08-30 15:57:38 +0000 |
|---|---|---|
| committer | Joe Orton <jorton@apache.org> | 2005-08-30 15:57:38 +0000 |
| commit | a1e9d51be373b9c9e537d129a48e140232643a9e (patch) | |
| tree | 35e72c8fde1a379bbf2af162ce8f70c3bb27d5f2 | |
| parent | 19a0d050b0c3ada98885cf83f9b8754a106e7beb (diff) | |
| download | httpd-a1e9d51be373b9c9e537d129a48e140232643a9e.tar.gz | |
Fix CVE CAN-2005-2700:
* modules/ssl/ssl_engine_kernel.c (ssl_hook_Access): Ensure that
renegotiation is performed for a transition from "SSLVerifyClient
optional" to "SSLVerifyClient require".
The boolean "verify_old & SSL_VERIFY_PEER_STRICT" is true if the old
context merely has optional verification configured, since the
definition of SSL_VERIFY_PEER_STRICT is
(SSL_VERIFY_FAIL_IF_NO_PEER_CERT | SSL_VERIFY_PEER).
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@264800 13f79535-47bb-0310-9956-ffa450edef68
| -rw-r--r-- | CHANGES | 5 | ||||
| -rw-r--r-- | modules/ssl/ssl_engine_kernel.c | 4 |
2 files changed, 7 insertions, 2 deletions
@@ -2,6 +2,11 @@ Changes with Apache 2.3.0 [Remove entries to the current 2.0 and 2.2 section below, when backported] + *) SECURITY: CAN-2005-2700 (cve.mitre.org) + mod_ssl: Fix a security issue where "SSLVerifyClient" was not + enforced in per-location context if "SSLVerifyClient optional" + was configured in the vhost configuration. [Joe Orton] + *) mod_cgid: run the get_suexec_identity hook within the request-handler instead of within cgid. PR36410. [Colm MacCarthaigh] diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c index 25b8a4879f..02ee92a806 100644 --- a/modules/ssl/ssl_engine_kernel.c +++ b/modules/ssl/ssl_engine_kernel.c @@ -406,8 +406,8 @@ int ssl_hook_Access(request_rec *r) (!(verify_old & SSL_VERIFY_PEER) && (verify & SSL_VERIFY_PEER)) || - (!(verify_old & SSL_VERIFY_PEER_STRICT) && - (verify & SSL_VERIFY_PEER_STRICT))) + (!(verify_old & SSL_VERIFY_FAIL_IF_NO_PEER_CERT) && + (verify & SSL_VERIFY_FAIL_IF_NO_PEER_CERT))) { renegotiate = TRUE; /* optimization */ |