RedHat: Important: mod_ssl security update
Summary
Summary
The mod_ssl module provides strong cryptography for the Apache Web server via the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols. A flaw was discovered in mod_ssl's handling of the "SSLVerifyClient" directive. This flaw occurs if a virtual host is configured using "SSLVerifyClient optional" and a directive "SSLVerifyClient required" is set for a specific location. For servers configured in this fashion, an attacker may be able to access resources that should otherwise be protected, by not supplying a client certificate when connecting. The Common Vulnerabilities and Exposures project assigned the name CAN-2005-2700 to this issue. Users of mod_ssl should upgrade to this updated package, which contains a backported patch to correct this issue.
Solution
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:
up2date
This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.
5. Bug IDs fixed (http://bugzilla.redhat.com/):
167195 - CAN-2005-2700 SSLVerifyClient flaw
6. RPMs required:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1:
SRPMS:
70c9491a26f4192159f0874a415f32f4 mod_ssl-2.8.12-8.src.rpm
i386:
a8b75736c811bd68b755505e156e4904 mod_ssl-2.8.12-8.i386.rpm
ia64:
b24dc850c203e5c354773b07a6c19a5a mod_ssl-2.8.12-8.ia64.rpm
Red Hat Linux Advanced Workstation 2.1:
SRPMS:
70c9491a26f4192159f0874a415f32f4 mod_ssl-2.8.12-8.src.rpm
ia64:
b24dc850c203e5c354773b07a6c19a5a mod_ssl-2.8.12-8.ia64.rpm
Red Hat Enterprise Linux ES version 2.1:
SRPMS:
70c9491a26f4192159f0874a415f32f4 mod_ssl-2.8.12-8.src.rpm
i386:
a8b75736c811bd68b755505e156e4904 mod_ssl-2.8.12-8.i386.rpm
Red Hat Enterprise Linux WS version 2.1:
SRPMS:
70c9491a26f4192159f0874a415f32f4 mod_ssl-2.8.12-8.src.rpm
i386:
a8b75736c811bd68b755505e156e4904 mod_ssl-2.8.12-8.i386.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2700
Package List
Topic
Topic
Relevant Releases Architectures
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64
Red Hat Linux Advanced Workstation 2.1 - ia64
Red Hat Enterprise Linux ES version 2.1 - i386
Red Hat Enterprise Linux WS version 2.1 - i386
Bugs Fixed