CVE-2008-0555

The ExpandCert function in Apache-SSL before apache_1.3.41+ssl_1.59 does not properly handle (1) '/' and (2) '=' characters in a Distinguished Name (DN) in a…

published April 4, 2008

CVSS
—
EPSS
2%
Percentile
79.1
In the wild
Unconfirmed
What it is

The ExpandCert function in Apache-SSL before apache_1.3.41+ssl_1.59 does not properly handle (1) '/' and (2) '=' characters in a Distinguished Name (DN) in a client certificate, which might allow remote attackers to bypass authentication via a crafted DN that triggers overwriting of environment variables.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01870 · 79.1th percentile
Published
2008-04-04T00:00Z
EPSS history
Timeline
  • 04 APR 00:00Z
    The ExpandCert function in Apache-SSL before apache_1.3.41+ssl_1.59 does not properly handle (1) '/' and (2) '=' characters in a Distinguished Name (DN) in a…
    cvelistv5