PatchTheCVEapache-ssl vulnerabilities and fixes
Recent CVEs affecting apache-ssl, with upgrade or downgrade steps. 3 tracked.
Also searched as: apache ssl.
apache-ssl has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 1. Most recent: 2008-04-04. Highest priority: CVE-2002-0082 (score 61/100).
- CVE-2008-0555 HIGH 7.5 DOWNGRADE The ExpandCert function in Apache-SSL before apache_1.3.41+ssl_1.59 does not properly handle (1) '/' and (2) '
- CVE-2004-0009 HIGH 7.5 UPGRADE Apache-SSL 1.3.28+1.52 and earlier, with SSLVerifyClient set to 1 or 3 and SSLFakeBasicAuth enabled, allows re
- CVE-2002-0082 HIGH 7.5 DOWNGRADE DOWNGRADE The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before 1.3.22+1.46, does not
FAQ
How do I fix apache-ssl vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is apache-ssl being exploited right now?
None of the tracked apache-ssl CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which apache-ssl CVE should I patch first?
CVE-2002-0082 currently ranks highest (61/100): The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before 1.3.22+1.46, does not.