CVE-2004-0885
The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the "SSLCipherSuite" directive in...
7.5 HighFix available
CVE-2004-0885 is a high vulnerability (CVSS 7.5) in Apache Http Server, published October 16, 2004. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 15.4%, the 96th percentile. Fixed in apache2 2.0.52-2.
The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the "SSLCipherSuite" directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration.
Exploit likelihood
15.4%Up 10.1 points since Feb 4, 2022
What each source reports
NVD Score used
The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the "SSLCipherSuite" directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration.
- Record
CVE-2004-0885- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the "SSLCipherSuite" directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration.
- Record
CVE-2004-0885- Updated
- 2026-11-02
EUVDEUVD-2004-0883 No score
The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the "SSLCipherSuite" directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration.
- Record
EUVD-2004-0883- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xxhg-c875-v6qf No score
The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the "SSLCipherSuite" directive in...
The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the "SSLCipherSuite" directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration.
- Record
GHSA-xxhg-c875-v6qf- Updated
- 2026-11-02
OSVBELL-CVE-2004-0885
CVE-2004-0885 does not affect BellSoft software
- Record
BELL-CVE-2004-0885- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
OSV No score
The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the "SSLCipherSuite" directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration.
- Record
CVE-2004-0885- Updated
- 2026-11-02
OSVDEBIAN-CVE-2004-0885 No score
The mod_ssl module in Apache 2.0.35 through 2.0.52, when using the "SSLCipherSuite" directive in directory or location context, allows remote clients to bypass intended restrictions by using any cipher suite that is allowed by the virtual host configuration.
- Record
DEBIAN-CVE-2004-0885- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
apache2Debian:12 |
before 2.0.52-2 | 2.0.52-2 |
apache2Debian:13 |
before 2.0.52-2 | 2.0.52-2 |
apache2Debian:14 |
before 2.0.52-2 | 2.0.52-2 |
httpdRed Hat:enterprise_linux:3::as |
before 0:2.0.46-44.ent | 0:2.0.46-44.ent |
httpd-debuginfoRed Hat:enterprise_linux:3::as |
before 0:2.0.46-44.ent | 0:2.0.46-44.ent |
httpd-develRed Hat:enterprise_linux:3::as |
before 0:2.0.46-44.ent | 0:2.0.46-44.ent |
mod_sslRed Hat:enterprise_linux:3::as |
before 1:2.0.46-44.ent | 1:2.0.46-44.ent |
httpdRed Hat:enterprise_linux:3::desktop |
before 0:2.0.46-44.ent | 0:2.0.46-44.ent |
httpd-debuginfoRed Hat:enterprise_linux:3::desktop |
before 0:2.0.46-44.ent | 0:2.0.46-44.ent |
httpd-develRed Hat:enterprise_linux:3::desktop |
before 0:2.0.46-44.ent | 0:2.0.46-44.ent |
Show 51 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mod_sslRed Hat:enterprise_linux:3::desktop |
before 1:2.0.46-44.ent | 1:2.0.46-44.ent |
httpdRed Hat:enterprise_linux:3::es |
before 0:2.0.46-44.ent | 0:2.0.46-44.ent |
httpd-debuginfoRed Hat:enterprise_linux:3::es |
before 0:2.0.46-44.ent | 0:2.0.46-44.ent |
httpd-develRed Hat:enterprise_linux:3::es |
before 0:2.0.46-44.ent | 0:2.0.46-44.ent |
mod_sslRed Hat:enterprise_linux:3::es |
before 1:2.0.46-44.ent | 1:2.0.46-44.ent |
httpdRed Hat:enterprise_linux:3::ws |
before 0:2.0.46-44.ent | 0:2.0.46-44.ent |
httpd-debuginfoRed Hat:enterprise_linux:3::ws |
before 0:2.0.46-44.ent | 0:2.0.46-44.ent |
httpd-develRed Hat:enterprise_linux:3::ws |
before 0:2.0.46-44.ent | 0:2.0.46-44.ent |
mod_sslRed Hat:enterprise_linux:3::ws |
before 1:2.0.46-44.ent | 1:2.0.46-44.ent |
jabberdRed Hat:network_satellite:5.0:el4 |
before 0:2.0s10-3.38.rhn | 0:2.0s10-3.38.rhn |
java-1.4.2-ibmRed Hat:network_satellite:5.0:el4 |
before 0:1.4.2.10-1jpp.2.el4 | 0:1.4.2.10-1jpp.2.el4 |
java-1.4.2-ibm-develRed Hat:network_satellite:5.0:el4 |
before 0:1.4.2.10-1jpp.2.el4 | 0:1.4.2.10-1jpp.2.el4 |
jfreechartRed Hat:network_satellite:5.0:el4 |
before 0:0.9.20-3.rhn | 0:0.9.20-3.rhn |
openmotif21Red Hat:network_satellite:5.0:el4 |
before 0:2.1.30-11.RHEL4.6 | 0:2.1.30-11.RHEL4.6 |
openmotif21-debuginfoRed Hat:network_satellite:5.0:el4 |
before 0:2.1.30-11.RHEL4.6 | 0:2.1.30-11.RHEL4.6 |
perl-Crypt-CBCRed Hat:network_satellite:5.0:el4 |
before 0:2.24-1.el4 | 0:2.24-1.el4 |
rhn-apacheRed Hat:network_satellite:5.0:el4 |
before 0:1.3.27-36.rhn.rhel4 | 0:1.3.27-36.rhn.rhel4 |
rhn-modjk-ap13Red Hat:network_satellite:5.0:el4 |
before 0:1.2.23-2rhn.rhel4 | 0:1.2.23-2rhn.rhel4 |
rhn-modperlRed Hat:network_satellite:5.0:el4 |
before 0:1.29-16.rhel4 | 0:1.29-16.rhel4 |
rhn-modsslRed Hat:network_satellite:5.0:el4 |
before 0:2.8.12-8.rhn.10.rhel4 | 0:2.8.12-8.rhn.10.rhel4 |
tomcat5Red Hat:network_satellite:5.0:el4 |
before 0:5.0.30-0jpp_10rh | 0:5.0.30-0jpp_10rh |
jabberdRed Hat:network_proxy:4.2::el3 |
before 0:2.0s10-3.37.rhn | 0:2.0s10-3.37.rhn |
rhn-apacheRed Hat:network_proxy:4.2::el3 |
before 0:1.3.27-36.rhn.rhel3 | 0:1.3.27-36.rhn.rhel3 |
rhn-modperlRed Hat:network_proxy:4.2::el3 |
before 0:1.29-16.rhel3 | 0:1.29-16.rhel3 |
jabberdRed Hat:network_proxy:4.2::el4 |
before 0:2.0s10-3.38.rhn | 0:2.0s10-3.38.rhn |
rhn-apacheRed Hat:network_proxy:4.2::el4 |
before 0:1.3.27-36.rhn.rhel4 | 0:1.3.27-36.rhn.rhel4 |
rhn-modperlRed Hat:network_proxy:4.2::el4 |
before 0:1.29-16.rhel4 | 0:1.29-16.rhel4 |
jabberdRed Hat:network_satellite:4.2::el3 |
before 0:2.0s10-3.37.rhn | 0:2.0s10-3.37.rhn |
java-1.4.2-ibmRed Hat:network_satellite:4.2::el3 |
before 0:1.4.2.10-1jpp.2.el3 | 0:1.4.2.10-1jpp.2.el3 |
java-1.4.2-ibm-develRed Hat:network_satellite:4.2::el3 |
before 0:1.4.2.10-1jpp.2.el3 | 0:1.4.2.10-1jpp.2.el3 |
jfreechartRed Hat:network_satellite:4.2::el3 |
before 0:0.9.20-3.rhn | 0:0.9.20-3.rhn |
openmotif21Red Hat:network_satellite:4.2::el3 |
before 0:2.1.30-9.RHEL3.8 | 0:2.1.30-9.RHEL3.8 |
openmotif21-debuginfoRed Hat:network_satellite:4.2::el3 |
before 0:2.1.30-9.RHEL3.8 | 0:2.1.30-9.RHEL3.8 |
perl-Crypt-CBCRed Hat:network_satellite:4.2::el3 |
before 0:2.24-1.el3 | 0:2.24-1.el3 |
rhn-apacheRed Hat:network_satellite:4.2::el3 |
before 0:1.3.27-36.rhn.rhel3 | 0:1.3.27-36.rhn.rhel3 |
rhn-modjk-ap13Red Hat:network_satellite:4.2::el3 |
before 0:1.2.23-2rhn.rhel3 | 0:1.2.23-2rhn.rhel3 |
rhn-modperlRed Hat:network_satellite:4.2::el3 |
before 0:1.29-16.rhel3 | 0:1.29-16.rhel3 |
rhn-modsslRed Hat:network_satellite:4.2::el3 |
before 0:2.8.12-8.rhn.10.rhel3 | 0:2.8.12-8.rhn.10.rhel3 |
tomcat5Red Hat:network_satellite:4.2::el3 |
before 0:5.0.30-0jpp_10rh | 0:5.0.30-0jpp_10rh |
jabberdRed Hat:network_satellite:4.2::el4 |
before 0:2.0s10-3.38.rhn | 0:2.0s10-3.38.rhn |
java-1.4.2-ibmRed Hat:network_satellite:4.2::el4 |
before 0:1.4.2.10-1jpp.2.el4 | 0:1.4.2.10-1jpp.2.el4 |
java-1.4.2-ibm-develRed Hat:network_satellite:4.2::el4 |
before 0:1.4.2.10-1jpp.2.el4 | 0:1.4.2.10-1jpp.2.el4 |
jfreechartRed Hat:network_satellite:4.2::el4 |
before 0:0.9.20-3.rhn | 0:0.9.20-3.rhn |
openmotif21Red Hat:network_satellite:4.2::el4 |
before 0:2.1.30-11.RHEL4.6 | 0:2.1.30-11.RHEL4.6 |
openmotif21-debuginfoRed Hat:network_satellite:4.2::el4 |
before 0:2.1.30-11.RHEL4.6 | 0:2.1.30-11.RHEL4.6 |
perl-Crypt-CBCRed Hat:network_satellite:4.2::el4 |
before 0:2.24-1.el4 | 0:2.24-1.el4 |
rhn-apacheRed Hat:network_satellite:4.2::el4 |
before 0:1.3.27-36.rhn.rhel4 | 0:1.3.27-36.rhn.rhel4 |
rhn-modjk-ap13Red Hat:network_satellite:4.2::el4 |
before 0:1.2.23-2rhn.rhel4 | 0:1.2.23-2rhn.rhel4 |
rhn-modperlRed Hat:network_satellite:4.2::el4 |
before 0:1.29-16.rhel4 | 0:1.29-16.rhel4 |
rhn-modsslRed Hat:network_satellite:4.2::el4 |
before 0:2.8.12-8.rhn.10.rhel4 | 0:2.8.12-8.rhn.10.rhel4 |
tomcat5Red Hat:network_satellite:4.2::el4 |
before 0:5.0.30-0jpp_10rh | 0:5.0.30-0jpp_10rh |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
securityfocus.com/bid/11360
redhat.com/support/errata/RHSA-2004-562.html
support.avaya.com/elmodocs2/security/ASA-2006-081.htm
ubuntu.com/usn/usn-177-1
marc.info?l=bugtraq&m=109786159119069&w=2
Show 194 moreShow less
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10384
secunia.com/advisories/19072
www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX01123
exchange.xforce.ibmcloud.com/vulnerabilities/17671
lists.apple.com/archives/security-announce/2005/Aug/msg00000.html
sunsolve.sun.com/search/document.do?assetkey=1-26-102198-1
issues.apache.org/bugzilla/show_bug.cgi?id=31505
vupen.com/english/advisories/2006/0789
apacheweek.com/features/security-20
lists.apache.org/thread.html/54a42d4b01968df1117cea77fc53d6beb931c0e05936ad02af93e9ac%40%3Ccvs.httpd.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2004-0885
github.com/advisories/GHSA-xxhg-c875-v6qf
docs.bell-sw.com/security/cves/CVE-2004-0885
security-tracker.debian.org/tracker/CVE-2004-0885
access.redhat.com/errata/RHSA-2004:562
bugzilla.redhat.com/show_bug.cgi?id=134825
security.access.redhat.com/data/csaf/v2/advisories/2004/rhsa-2004_562.json
cve.org/CVERecord?id=CVE-2004-0885
This page doesn't list everything
Left out here: 35 references. The JSON record has them.