CVE-2016-4979

The Apache HTTP Server 2.4.18 through 2.4.20, when mod_http2 and mod_ssl are enabled, does not properly recognize the "SSLVerifyClient require" directive for…

published July 6, 2016

CVSS
—
EPSS
19%
Percentile
97.3
In the wild
Unconfirmed
What it is

The Apache HTTP Server 2.4.18 through 2.4.20, when mod_http2 and mod_ssl are enabled, does not properly recognize the "SSLVerifyClient require" directive for HTTP/2 request authorization, which allows remote attackers to bypass intended access restrictions by leveraging the ability to send multiple requests over a single connection and aborting a renegotiation.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.18802 · 97.3th percentile
Published
2016-07-06T14:00Z
EPSS history
Timeline
  • 06 JUL 14:00Z
    The Apache HTTP Server 2.4.18 through 2.4.20, when mod_http2 and mod_ssl are enabled, does not properly recognize the "SSLVerifyClient require" directive for…
    cvelistv5