Bug#327210: marked as done (apache2: CAN-2005-2700)
Your message dated Fri, 09 Sep 2005 10:10:22 +1000
with message-id <4320D2EE.1080405@0c3.net>
and subject line Closing this bug.
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 8 Sep 2005 11:56:17 +0000
>From jk@blackdown.de Thu Sep 08 04:56:17 2005
Return-path: <jk@blackdown.de>
Received: from smtp.blackdown.de [213.239.206.42]
by spohr.debian.org with esmtp (Exim 3.36 1 (Debian))
id 1EDL0r-00059N-00; Thu, 08 Sep 2005 04:56:17 -0700
Received: from p50909074.dip0.t-ipconnect.de ([80.144.144.116] ident=[oOVMVvEhkZdhuzXZN38gshWY7Yo6U33e])
by smtp.blackdown.de with esmtpsa (TLS-1.0:RSA_AES_256_CBC_SHA:32)
(Exim 4.50)
id 1EDL0f-0008K3-S0
for submit@bugs.debian.org; Thu, 08 Sep 2005 13:56:05 +0200
Received: from fry.jknet ([192.168.1.2] ident=[btV3bMm6pD4ub1LvHGFVPLglcm44NJoB])
by server.jknet with esmtps (TLS-1.0:RSA_AES_256_CBC_SHA:32)
(Exim 4.50)
id 1EDL0W-0006NV-Nx
for submit@bugs.debian.org; Thu, 08 Sep 2005 13:55:56 +0200
Received: from jk by fry.jknet with local (Exim 4.52)
id 1EDL0W-0007OT-Dp
for submit@bugs.debian.org; Thu, 08 Sep 2005 13:55:56 +0200
From: Juergen Kreileder <jk@blackdown.de>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: apache2: CAN-2005-2700
X-PGP-Key: http://blackhole.pca.dfn.de:11371/pks/lookup?op=get&search=0x730A28A5
X-PGP-Fingerprint: 7C19 D069 9ED5 DC2E 1B10 9859 C027 8D5B 730A 28A5
X-Debbugs-CC: Juergen Kreileder <jk@blackdown.de>
Date: Thu, 08 Sep 2005 13:55:56 +0200
Message-ID: <[🔎] 87acinlqnn.fsf@blackdown.de>
Organization: Blackdown Java-Linux Team
Lines: 21
User-Agent: Gnus/5.110003 (No Gnus v0.3) Emacs/21.4 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Delivered-To: submit@bugs.debian.org
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Level:
X-Spam-Status: No, hits=-11.0 required=4.0 tests=BAYES_00,HAS_PACKAGE,
X_DEBBUGS_CC autolearn=ham version=2.60-bugs.debian.org_2005_01_02
Package: apache2
Version: 2.0.54-4
Severity: critical
Tags: security, fixed-upstream
See http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2700
,----
| ssl_engine_kernel.c in mod_ssl before 2.8.24, when using
| "SSLVerifyClient optional" in the global virtual host configuration,
| does not properly enforce "SSLVerifyClient require" in a per-location
| context, which allows remote attackers to bypass intended access
| restrictions.
`----
Juergen
--
Juergen Kreileder, Blackdown Java-Linux Team
http://blog.blackdown.de/
---------------------------------------
Received: (at 327210-done) by bugs.debian.org; 9 Sep 2005 00:11:03 +0000
>From adconrad@0c3.net Thu Sep 08 17:11:03 2005
Return-path: <adconrad@0c3.net>
Received: from loki.0c3.net [69.0.240.48]
by spohr.debian.org with esmtp (Exim 3.36 1 (Debian))
id 1EDWTv-0008HJ-00; Thu, 08 Sep 2005 17:11:03 -0700
Received: from [203.49.196.168] (helo=[10.0.0.4])
by loki.0c3.net with esmtp (Exim 4.34)
id 1EDWTN-0003xC-V1
for 327210-done@bugs.debian.org; Thu, 08 Sep 2005 18:10:30 -0600
Message-ID: <4320D2EE.1080405@0c3.net>
Date: Fri, 09 Sep 2005 10:10:22 +1000
From: Adam Conrad <adconrad@0c3.net>
User-Agent: Mozilla Thunderbird 1.0.6 (X11/20050831)
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: 327210-done@bugs.debian.org
Subject: Closing this bug.
X-Enigmail-Version: 0.92.0.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Delivered-To: 327210-done@bugs.debian.org
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Level:
X-Spam-Status: No, hits=-3.0 required=4.0 tests=BAYES_00 autolearn=no
version=2.60-bugs.debian.org_2005_01_02
The update has been released, as 2.0.54-5, so closing this bug.
... Adam
Reply to: