Commit 9fa4ba97 authored by Jeff Trawick's avatar Jeff Trawick
Browse files

backport from trunk and 2.2.x: 

   SECURITY: CAN-2005-2700 (cve.mitre.org)
   mod_ssl: Fix a security issue where "SSLVerifyClient" was not
   enforced in per-location context if "SSLVerifyClient optional"
   was configured in the vhost configuration.

Submitted by: Joe Orton
Reviewed by: wrowe, trawick
  


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@307220 13f79535-47bb-0310-9956-ffa450edef68
parent 3ca34697

CHANGES

+5 −0
Changes for CHANGES: 5 added lines, 0 removed lines.
Original line number Diff line number Diff line 
                                                         -*- coding: utf-8 -*-

Changes with Apache 2.0.55









  *) SECURITY: CAN-2005-2700 (cve.mitre.org)









     mod_ssl: Fix a security issue where "SSLVerifyClient" was not









     enforced in per-location context if "SSLVerifyClient optional"









     was configured in the vhost configuration.  [Joe Orton]

















  *) worker MPM: Fix a memory leak which can occur after an aborted









     connection in some limited circumstances.  [Greg Ames]










































STATUS



+0
−6



























Changes for STATUS: 0 added lines, 6 removed lines.



Original line number
Diff line number
Diff line







@@ -104,12 +104,6 @@ CURRENT RELEASE NOTES:

















RELEASE SHOWSTOPPERS:



















    *) Fix CAN-2005-2700, mod_ssl SSLVerifyClient bug









         http://svn.apache.org/viewcvs?rev=264800&view=rev









       test case: perl-framework/t/security/CAN-2005-2700.t









       +1: jorton, wrowe, trawick









       wrowe cautions to backport to 2.2.x branch as well.



















PATCHES ACCEPTED TO BACKPORT FROM TRUNK:









  [ start all new proposals below, under PATCHES PROPOSED. ]












































modules/ssl/ssl_engine_kernel.c



+2
−2



























Changes for modules/ssl/ssl_engine_kernel.c: 2 added lines, 2 removed lines.



Original line number
Diff line number
Diff line







@@ -406,8 +406,8 @@ int ssl_hook_Access(request_rec *r)







                (!(verify_old & SSL_VERIFY_PEER) &&









                  (verify     & SSL_VERIFY_PEER)) ||



















                (!(verify_old & SSL_VERIFY_PEER_STRICT) &&









                  (verify     & SSL_VERIFY_PEER_STRICT)))









                (!(verify_old & SSL_VERIFY_FAIL_IF_NO_PEER_CERT) &&









                  (verify     & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)))









            {









                renegotiate = TRUE;









                /* optimization */