CVE-2016-4979
CVE-2016-4979
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
The Apache HTTP Server 2.4.18 through 2.4.20, when mod_http2 and mod_ssl are enabled, does not properly recognize the "SSLVerifyClient require" directive for HTTP/2 request authorization, which allows remote attackers to bypass intended access restrictions by leveraging the ability to send multiple requests over a single connection and aborting a renegotiation.
CVSS 7.5 · High · EPSS 18.8% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
Original sources
- https://access.redhat.com/errata/RHSA-2016:1420
- http://httpd.apache.org/security/vulnerabilities_24.html
- https://security.gentoo.org/glsa/201610-02
- http://seclists.org/fulldisclosure/2016/Jul/11
- http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html
- http://www.apache.org/dist/httpd/CHANGES_2.4
- http://www.securityfocus.com/bid/91566
- http://www.oracle.com/technetwork/topics/security/bulletinoct2016-3090566.html
- http://www.securitytracker.com/id/1036225
- http://www.openwall.com/lists/oss-security/2016/07/05/5
- https://github.com/apache/httpd/commit/2d0e4eff04ea963128a41faaef21f987272e05a2
- http://packetstormsecurity.com/files/137771/Apache-2.4.20-X509-Authentication-Bypass.html
- https://security.netapp.com/advisory/ntap-20180601-0001/
- https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/re1e3a24664d35bcd0a0e793e0b5fc6ca6c107f99a1b2c545c5d4b467%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r04e89e873d54116a0635ef2f7061c15acc5ed27ef7500997beb65d6f%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E
- https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2016-4979