Bug 1131321 - (CVE-2019-0215) VUL-0: CVE-2019-0215: apache2: mod_ssl access control bypass
(CVE-2019-0215)
VUL-0: CVE-2019-0215: apache2: mod_ssl access control bypass
Status: RESOLVED DUPLICATE of bug 1131243
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Major
: ---
Assigned To: Petr Gajdos
Security Team bot
https://smash.suse.de/issue/228633/
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2019-04-02 15:29 UTC by Marcus Meissner
Modified: 2019-04-03 12:48 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2019-04-02 15:29:12 UTC
rh#1695025

In Apache HTTP Server 2.4 releases 2.4.37 and 2.4.38, a bug in mod_ssl when using per-location client certificate verification with TLSv1.3 allowed a client supporting Post-Handshake Authentication to bypass configured access control restrictions.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1695025
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-0215
http://seclists.org/oss-sec/2019/q2/3
http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-0215.html
Comment 1 Petr Gajdos 2019-04-03 12:48:10 UTC
Duplicate report.

*** This bug has been marked as a duplicate of bug 1131243 ***