svn propchange: r1927043 - svn:log

[co...@apache.org]

Author: covener
Revision: 1927043
Modified property: svn:log

Modified: svn:log at Thu Jul 10 17:25:42 2025
------------------------------------------------------------------------------
--- svn:log (original)
+++ svn:log Thu Jul 10 17:25:42 2025
@@ -1,6 +1,21 @@
 backport 1927035 from trunk
 
-  update SNI validation
+
+  *) SECURITY: CVE-2025-23048: Apache HTTP Server: mod_ssl access
+     control bypass with session resumption (cve.mitre.org)
+     In some mod_ssl configurations on Apache HTTP Server 2.4.35
+     through to 2.4.62, an access control bypass by trusted clients
+     is possible using TLS 1.3 session resumption.
+     Configurations are affected when mod_ssl is configured for
+     multiple virtual hosts, with each restricted to a different set
+     of trusted client certificates (for example with a different
+     SSLCACertificateFile/Path setting). In such a case, a client
+     trusted to access one virtual host may be able to access another
+     virtual host, if SSLStrictSNIVHostCheck is not enabled in either
+     virtual host.
+     Credits: Sven Hebrok, Felix Cramer, Tim Storm, Maximilian Radoy,
+     and Juraj Somorovsky at Paderborn University
+
 
 Reviewed By: rpluem, jorton, covener, ylavic