CVE-2005-2700
ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global...
10.0 HighFix available
ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.
Exploit likelihood
30.6%Up 23.2 points since Feb 4, 2022
What each source reports
NVD Score used
ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.
- Record
CVE-2005-2700- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.
- Record
CVE-2005-2700- Updated
- 2026-11-02
EUVDEUVD-2005-2701 No score
ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.
- Record
EUVD-2005-2701- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6h5v-qgqr-fmq8 No score
ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global...
ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.
- Record
GHSA-6h5v-qgqr-fmq8- Updated
- 2026-11-02
OSV No score
ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.
- Record
CVE-2005-2700- Updated
- 2026-11-02
OSVDEBIAN-CVE-2005-2700 No score
ssl_engine_kernel.c in mod_ssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions.
- Record
DEBIAN-CVE-2005-2700- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
apache2Debian:12 |
before 2.0.54-5 | 2.0.54-5 |
apache2Debian:13 |
before 2.0.54-5 | 2.0.54-5 |
apache2Debian:14 |
before 2.0.54-5 | 2.0.54-5 |
apache2Debian:3.1 From an advisory covering 4 CVEs |
before 2.0.54-5, plus listed versions 2.0.54-4 |
2.0.54-5 |
libapache-mod-sslDebian:3.0 |
before 2.8.9-2.5, plus listed versions 2.4.10-1.3.9-1potato22.4.10-1.3.9-1potato42.8.7-12.8.9-2.4 |
2.8.9-2.5 |
libapache-mod-sslDebian:3.1 |
before 2.8.22-1sarge1, plus listed versions 2.8.22-1 |
2.8.22-1sarge1 |
httpdRed Hat:enterprise_linux:3::as From an advisory covering 2 CVEs |
before 0:2.0.46-46.3.ent | 0:2.0.46-46.3.ent |
httpd-debuginfoRed Hat:enterprise_linux:3::as From an advisory covering 2 CVEs |
before 0:2.0.46-46.3.ent | 0:2.0.46-46.3.ent |
httpd-develRed Hat:enterprise_linux:3::as From an advisory covering 2 CVEs |
before 0:2.0.46-46.3.ent | 0:2.0.46-46.3.ent |
mod_sslRed Hat:enterprise_linux:3::as From an advisory covering 2 CVEs |
before 1:2.0.46-46.3.ent | 1:2.0.46-46.3.ent |
Show 36 moreShow less
| Package | Affected | Fixed |
|---|---|---|
httpdRed Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs |
before 0:2.0.46-46.3.ent | 0:2.0.46-46.3.ent |
httpd-debuginfoRed Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs |
before 0:2.0.46-46.3.ent | 0:2.0.46-46.3.ent |
httpd-develRed Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs |
before 0:2.0.46-46.3.ent | 0:2.0.46-46.3.ent |
mod_sslRed Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs |
before 1:2.0.46-46.3.ent | 1:2.0.46-46.3.ent |
httpdRed Hat:enterprise_linux:3::es From an advisory covering 2 CVEs |
before 0:2.0.46-46.3.ent | 0:2.0.46-46.3.ent |
httpd-debuginfoRed Hat:enterprise_linux:3::es From an advisory covering 2 CVEs |
before 0:2.0.46-46.3.ent | 0:2.0.46-46.3.ent |
httpd-develRed Hat:enterprise_linux:3::es From an advisory covering 2 CVEs |
before 0:2.0.46-46.3.ent | 0:2.0.46-46.3.ent |
mod_sslRed Hat:enterprise_linux:3::es From an advisory covering 2 CVEs |
before 1:2.0.46-46.3.ent | 1:2.0.46-46.3.ent |
httpdRed Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs |
before 0:2.0.46-46.3.ent | 0:2.0.46-46.3.ent |
httpd-debuginfoRed Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs |
before 0:2.0.46-46.3.ent | 0:2.0.46-46.3.ent |
httpd-develRed Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs |
before 0:2.0.46-46.3.ent | 0:2.0.46-46.3.ent |
mod_sslRed Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs |
before 1:2.0.46-46.3.ent | 1:2.0.46-46.3.ent |
httpdRed Hat:enterprise_linux:4::as From an advisory covering 2 CVEs |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
httpd-debuginfoRed Hat:enterprise_linux:4::as From an advisory covering 2 CVEs |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
httpd-develRed Hat:enterprise_linux:4::as From an advisory covering 2 CVEs |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
httpd-manualRed Hat:enterprise_linux:4::as From an advisory covering 2 CVEs |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
httpd-suexecRed Hat:enterprise_linux:4::as From an advisory covering 2 CVEs |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
mod_sslRed Hat:enterprise_linux:4::as From an advisory covering 2 CVEs |
before 1:2.0.52-12.2.ent | 1:2.0.52-12.2.ent |
httpdRed Hat:enterprise_linux:4::desktop From an advisory covering 2 CVEs |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
httpd-debuginfoRed Hat:enterprise_linux:4::desktop From an advisory covering 2 CVEs |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
httpd-develRed Hat:enterprise_linux:4::desktop From an advisory covering 2 CVEs |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
httpd-manualRed Hat:enterprise_linux:4::desktop From an advisory covering 2 CVEs |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
httpd-suexecRed Hat:enterprise_linux:4::desktop From an advisory covering 2 CVEs |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
mod_sslRed Hat:enterprise_linux:4::desktop From an advisory covering 2 CVEs |
before 1:2.0.52-12.2.ent | 1:2.0.52-12.2.ent |
httpdRed Hat:enterprise_linux:4::es From an advisory covering 2 CVEs |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
httpd-debuginfoRed Hat:enterprise_linux:4::es From an advisory covering 2 CVEs |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
httpd-develRed Hat:enterprise_linux:4::es From an advisory covering 2 CVEs |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
httpd-manualRed Hat:enterprise_linux:4::es From an advisory covering 2 CVEs |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
httpd-suexecRed Hat:enterprise_linux:4::es From an advisory covering 2 CVEs |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
mod_sslRed Hat:enterprise_linux:4::es From an advisory covering 2 CVEs |
before 1:2.0.52-12.2.ent | 1:2.0.52-12.2.ent |
httpdRed Hat:enterprise_linux:4::ws From an advisory covering 2 CVEs |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
httpd-debuginfoRed Hat:enterprise_linux:4::ws From an advisory covering 2 CVEs |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
httpd-develRed Hat:enterprise_linux:4::ws From an advisory covering 2 CVEs |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
httpd-manualRed Hat:enterprise_linux:4::ws From an advisory covering 2 CVEs |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
httpd-suexecRed Hat:enterprise_linux:4::ws From an advisory covering 2 CVEs |
before 0:2.0.52-12.2.ent | 0:2.0.52-12.2.ent |
mod_sslRed Hat:enterprise_linux:4::ws From an advisory covering 2 CVEs |
before 1:2.0.52-12.2.ent | 1:2.0.52-12.2.ent |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2005-2700 is a high vulnerability (CVSS 10.0) in Apache Http Server, published September 6, 2005. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 30.6%, the 98th percentile. Fixed in apache2 2.0.54-5.
References
secunia.com/advisories/16705
debian.org/security/2005/dsa-807
marc.info?l=bugtraq&m=112870296926652&w=2
redhat.com/support/errata/RHSA-2005-608.html
Show 87 moreShow less
support.avaya.com/elmodocs2/security/ASA-2006-081.htm
vupen.com/english/advisories/2005/2659
lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html
novell.com/linux/security/advisories/2005_51_apache2.html
ubuntu.com/usn/usn-177-1
people.apache.org/~jorton/CAN-2005-2700.diff
mandriva.com/security/advisories?name=MDKSA-2005:161
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10416
www14.software.ibm.com/webapp/set2/subscriptions/pqvcmjd?mode=18&ID=3117
bugzilla.redhat.com/bugzilla/show_bug.cgi?id=167195
lists.opensuse.org/opensuse-security-announce/2006-09/msg00016.html
osvdb.org/19188
gentoo.org/security/en/glsa/glsa-200509-12.xml
securityfocus.com/bid/14721
kb.cert.org/vuls/id/744929
sunsolve.sun.com/search/document.do?assetkey=1-26-102197-1
lists.apache.org/thread.html/117bc3f09847ebf020b1bb70301ebcc105ddc446856150b63f37f8eb%40%3Cdev.httpd.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2005-2700
github.com/advisories/GHSA-6h5v-qgqr-fmq8
security-tracker.debian.org/tracker/CVE-2005-2700
access.redhat.com/errata/RHSA-2005:608
security.access.redhat.com/data/csaf/v2/advisories/2005/rhsa-2005_608.json
cve.org/CVERecord?id=CVE-2005-2700