PatchTheCVEmod ssl vulnerabilities and fixes
Recent CVEs affecting mod ssl, with upgrade or downgrade steps. 4 tracked.
Also searched as: modssl.
mod ssl has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2004-07-27. Highest priority: CVE-2002-0082 (score 61/100).
- CVE-2004-0700 HIGH 7.5 DOWNGRADE MITIGATE Format string vulnerability in the mod_proxy hook functions function in ssl_engine_log.c in mod_ssl before 2.8
- CVE-2002-1157 HIGH 7.5 UPGRADE Cross-site scripting vulnerability in the mod_ssl Apache module 2.8.9 and earlier, when UseCanonicalName is of
- CVE-2002-0653 HIGH 7.8 UPGRADE Off-by-one buffer overflow in the ssl_compat_directive function, as called by the rewrite_command hook for mod
- CVE-2002-0082 HIGH 7.5 DOWNGRADE DOWNGRADE The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before 1.3.22+1.46, does not
FAQ
How do I fix mod ssl vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is mod ssl being exploited right now?
None of the tracked mod ssl CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which mod ssl CVE should I patch first?
CVE-2002-0082 currently ranks highest (61/100): The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before 1.3.22+1.46, does not.