Commit a344c639 authored by Joe Orton's avatar Joe Orton
Browse files

Fix CVE CAN-2005-2700: 

* modules/ssl/ssl_engine_kernel.c (ssl_hook_Access): Ensure that
renegotiation is performed for a transition from "SSLVerifyClient
optional" to "SSLVerifyClient require".

The boolean "verify_old & SSL_VERIFY_PEER_STRICT" is true if the old
context merely has optional verification configured, since the
definition of SSL_VERIFY_PEER_STRICT is
(SSL_VERIFY_FAIL_IF_NO_PEER_CERT | SSL_VERIFY_PEER).


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@264800 13f79535-47bb-0310-9956-ffa450edef68
parent bc340de5

CHANGES

+5 −0
Original line number Diff line number Diff line
@@ -2,6 +2,11 @@ 
Changes with Apache 2.3.0

  [Remove entries to the current 2.0 and 2.2 section below, when backported]













  *) SECURITY: CAN-2005-2700 (cve.mitre.org)













     mod_ssl: Fix a security issue where "SSLVerifyClient" was not













     enforced in per-location context if "SSLVerifyClient optional"













     was configured in the vhost configuration.  [Joe Orton]



























  *) mod_cgid: run the get_suexec_identity hook within the request-handler 















     instead of within cgid. PR36410. [Colm MacCarthaigh]















































modules/ssl/ssl_engine_kernel.c



+2
−2






























Original line number
Diff line number
Diff line








@@ -406,8 +406,8 @@ int ssl_hook_Access(request_rec *r)













                (!(verify_old & SSL_VERIFY_PEER) &&















                  (verify     & SSL_VERIFY_PEER)) ||





























                (!(verify_old & SSL_VERIFY_PEER_STRICT) &&













                  (verify     & SSL_VERIFY_PEER_STRICT)))













                (!(verify_old & SSL_VERIFY_FAIL_IF_NO_PEER_CERT) &&













                  (verify     & SSL_VERIFY_FAIL_IF_NO_PEER_CERT)))















            {















                renegotiate = TRUE;















                /* optimization */