You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by tr...@apache.org on 2005/10/08 01:55:48 UTC
svn commit: r307220 - in /httpd/httpd/branches/2.0.x: CHANGES STATUS
modules/ssl/ssl_engine_kernel.c
Author: trawick
Date: Fri Oct 7 16:55:44 2005
New Revision: 307220
URL: http://svn.apache.org/viewcvs?rev=307220&view=rev
Log:
backport from trunk and 2.2.x:
SECURITY: CAN-2005-2700 (cve.mitre.org)
mod_ssl: Fix a security issue where "SSLVerifyClient" was not
enforced in per-location context if "SSLVerifyClient optional"
was configured in the vhost configuration.
Submitted by: Joe Orton
Reviewed by: wrowe, trawick
Modified:
httpd/httpd/branches/2.0.x/CHANGES
httpd/httpd/branches/2.0.x/STATUS
httpd/httpd/branches/2.0.x/modules/ssl/ssl_engine_kernel.c
Modified: httpd/httpd/branches/2.0.x/CHANGES
URL: http://svn.apache.org/viewcvs/httpd/httpd/branches/2.0.x/CHANGES?rev=307220&r1=307219&r2=307220&view=diff
==============================================================================
--- httpd/httpd/branches/2.0.x/CHANGES [utf-8] (original)
+++ httpd/httpd/branches/2.0.x/CHANGES [utf-8] Fri Oct 7 16:55:44 2005
@@ -1,6 +1,11 @@
-*- coding: utf-8 -*-
Changes with Apache 2.0.55
+ *) SECURITY: CAN-2005-2700 (cve.mitre.org)
+ mod_ssl: Fix a security issue where "SSLVerifyClient" was not
+ enforced in per-location context if "SSLVerifyClient optional"
+ was configured in the vhost configuration. [Joe Orton]
+
*) worker MPM: Fix a memory leak which can occur after an aborted
connection in some limited circumstances. [Greg Ames]
Modified: httpd/httpd/branches/2.0.x/STATUS
URL: http://svn.apache.org/viewcvs/httpd/httpd/branches/2.0.x/STATUS?rev=307220&r1=307219&r2=307220&view=diff
==============================================================================
--- httpd/httpd/branches/2.0.x/STATUS (original)
+++ httpd/httpd/branches/2.0.x/STATUS Fri Oct 7 16:55:44 2005
@@ -104,12 +104,6 @@
RELEASE SHOWSTOPPERS:
- *) Fix CAN-2005-2700, mod_ssl SSLVerifyClient bug
- http://svn.apache.org/viewcvs?rev=264800&view=rev
- test case: perl-framework/t/security/CAN-2005-2700.t
- +1: jorton, wrowe, trawick
- wrowe cautions to backport to 2.2.x branch as well.
-
PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
[ start all new proposals below, under PATCHES PROPOSED. ]
Modified: httpd/httpd/branches/2.0.x/modules/ssl/ssl_engine_kernel.c
URL: http://svn.apache.org/viewcvs/httpd/httpd/branches/2.0.x/modules/ssl/ssl_engine_kernel.c?rev=307220&r1=307219&r2=307220&view=diff
==============================================================================
--- httpd/httpd/branches/2.0.x/modules/ssl/ssl_engine_kernel.c (original)
+++ httpd/httpd/branches/2.0.x/modules/ssl/ssl_engine_kernel.c Fri Oct 7 16:55:44 2005
@@ -406,8 +406,8 @@
(!(verify_old & SSL_VERIFY_PEER) &&
(verify & SSL_VERIFY_PEER)) ||
- (!(verify_old & SSL_VERIFY_PEER_STRICT) &&
- (verify & SSL_VERIFY_PEER_STRICT)))
+ (!(verify_old & SSL_VERIFY_FAIL_IF_NO_PEER_CERT) &&
+ (verify & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)))
{
renegotiate = TRUE;
/* optimization */