{"id":"CVE-2013-4566","aliases":["EUVD-2013-4424","GHSA-c4hv-94wj-93p7","MGASA-2013-0381","RHSA-2013:1779","SUSE-RU-2015:0591-1","SUSE-SU-2016:2285-1","SUSE-SU-2016:2329-1","SUSE-SU-2016:2396-1","UBUNTU-CVE-2013-4566","openSUSE-SU-2024:10311-1"],"status":"published","title":"mod_nss 1.0.8 and earlier, when NSSVerifyClient is set to none for the server/vhost context, does...","description":"mod_nss 1.0.8 and earlier, when NSSVerifyClient is set to none for the server/vhost context, does not enforce the NSSVerifyClient setting in the directory context, which allows remote attackers to bypass intended access restrictions.","severity":{"version":"2.0","score":4,"vector":"AV:N/AC:H/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01949,"percentile":0.80351,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2013-12-12T18:00:00Z","modified":"2026-06-26T10:22:52Z","fixes":[{"ecosystem":"Mageia:3","package":"apache-mod_nss","fixed_in":["1.0.8-16.4.mga3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"mod_nss","fixed_in":["0:1.0.8-8.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"mod_nss-debuginfo","fixed_in":["0:1.0.8-8.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"mod_nss","fixed_in":["0:1.0.8-8.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"mod_nss-debuginfo","fixed_in":["0:1.0.8-8.el5_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"mod_nss","fixed_in":["0:1.0.8-19.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"mod_nss-debuginfo","fixed_in":["0:1.0.8-19.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"mod_nss","fixed_in":["0:1.0.8-19.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"mod_nss-debuginfo","fixed_in":["0:1.0.8-19.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"mod_nss","fixed_in":["0:1.0.8-19.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"mod_nss-debuginfo","fixed_in":["0:1.0.8-19.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"mod_nss","fixed_in":["0:1.0.8-19.el6_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"mod_nss-debuginfo","fixed_in":["0:1.0.8-19.el6_5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:3","package":"apache-mod_nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-16.4.mga3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"mod_nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.8-8.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"mod_nss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.8-8.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"mod_nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.8-8.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"mod_nss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.8-8.el5_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"mod_nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.8-19.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"mod_nss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.8-19.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"mod_nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.8-19.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"mod_nss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.8-19.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"mod_nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.8-19.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"mod_nss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.8-19.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"mod_nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.8-19.el6_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"mod_nss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.8-19.el6_5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"apache2-mod_nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.14-18.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"apache2-mod_nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.14-18.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"apache2-mod_nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.14-0.4.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager 2.1","package":"apache2-mod_nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.14-0.4.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 2.1","package":"apache2-mod_nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.14-0.4.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"apache2-mod_nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.14-0.4.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP2-LTSS","package":"apache2-mod_nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.14-0.4.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"apache2-mod_nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.14-0.4.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"apache2-mod_nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.14-0.4.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"apache2-mod_nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.14-0.4.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"apache2-mod_nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.14-0.4.25.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"apache2-mod_nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.14-10.14.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"apache2-mod_nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.14-10.14.3"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libapache2-mod-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.11-1","1.0.12-1","1.0.12-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libapache2-mod-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.14-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apache2-mod_nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.14-4.1"}]}],"bundled":4}],"products":[{"vendor":"mod_nss_project","product":"mod_nss"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1016832","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://rhn.redhat.com/errata/RHSA-2013-1779.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-12/msg00118.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4566","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-c4hv-94wj-93p7"},{"url":"https://advisories.mageia.org/MGASA-2013-0381.html","tags":["advisory"]},{"url":"https://rhn.redhat.com/errata/RHSA-2013-1779.html","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=11872","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2013:1779","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1779.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-4566","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4566","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement//suse-ru-20150591-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/847216","tags":["report"]},{"url":"https://bugzilla.suse.com/853039","tags":["report"]},{"url":"https://bugzilla.suse.com/863035","tags":["report"]},{"url":"https://bugzilla.suse.com/863518","tags":["report"]},{"url":"https://bugzilla.suse.com/864929","tags":["report"]},{"url":"https://bugzilla.suse.com/878681","tags":["report"]},{"url":"https://bugzilla.suse.com/897712","tags":["report"]},{"url":"https://bugzilla.suse.com/902068","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4566","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162285-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/972968","tags":["report"]},{"url":"https://bugzilla.suse.com/975394","tags":["report"]},{"url":"https://bugzilla.suse.com/979688","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3099","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162329-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162396-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2013-4566","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4566","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2013-4566","description":"mod_nss 1.0.8 and earlier, when NSSVerifyClient is set to none for the server/vhost context, does not enforce the NSSVerifyClient setting in the directory context, which allows remote attackers to bypass intended access restrictions.","status":"published","published":"2013-12-12T18:00:00Z","modified":"2024-08-06T16:45:15.24Z","updated_at":"2026-11-02T14:34:57.499208Z"}],"euvd":[{"id":"EUVD-2013-4424","description":"mod_nss 1.0.8 and earlier, when NSSVerifyClient is set to none for the server/vhost context, does not enforce the NSSVerifyClient setting in the directory context, which allows remote attackers to bypass intended access restrictions.","status":"published","published":"2013-12-12T18:00:00Z","modified":"2024-08-06T16:45:15Z","updated_at":"2026-11-03T01:56:31.067159Z"}],"ghsa":[{"id":"GHSA-c4hv-94wj-93p7","title":"mod_nss 1.0.8 and earlier, when NSSVerifyClient is set to none for the server/vhost context, does...","description":"mod_nss 1.0.8 and earlier, when NSSVerifyClient is set to none for the server/vhost context, does not enforce the NSSVerifyClient setting in the directory context, which allows remote attackers to bypass intended access restrictions.","status":"published","published":"2022-05-14T01:08:29Z","modified":"2023-02-02T05:03:08Z","updated_at":"2026-11-02T14:51:34.49846Z"}],"nvd":[{"id":"CVE-2013-4566","description":"mod_nss 1.0.8 and earlier, when NSSVerifyClient is set to none for the server/vhost context, does not enforce the NSSVerifyClient setting in the directory context, which allows remote attackers to bypass intended access restrictions.","status":"published","published":"2013-12-12T18:55:10.947Z","modified":"2026-06-16T23:57:27.89Z","cvss":[{"version":"2.0","score":4,"vector":"AV:N/AC:H/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:44.596064Z"}],"osv":[{"id":"MGASA-2013-0381","title":"Updated apache-mod_nss package fixes CVE-2013-4566","description":"Updated apache-mod_nss package fixes security vulnerability:\n\nA flaw was found in the way mod_nss handled the NSSVerifyClient setting for\nthe per-directory context. When configured to not require a client\ncertificate for the initial connection and only require it for a specific\ndirectory, mod_nss failed to enforce this requirement and allowed a client\nto access the directory when no valid client certificate was provided\n(CVE-2013-4566).\n","status":"published","published":"2013-12-20T17:27:18Z","modified":"2026-04-16T06:22:52.984646305Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10311-1","title":"apache2-mod_nss-1.0.14-4.1 on GA media","description":"These are all security issues fixed in the apache2-mod_nss-1.0.14-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:15:00.342661Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2013:1779","title":"Red Hat Security Advisory: mod_nss security update","status":"published","published":"2024-09-15T21:13:17Z","modified":"2026-06-26T10:22:52Z","updated_at":"2026-11-02T15:53:01.993625Z"},{"id":"SUSE-RU-2015:0591-1","title":"Recommended update for apache2-mod_nss","description":"\nThis update brings several improvements to apache2-mod_nss.\n\n    * \n\n      More TLS 1.2 ciphers have been added, including AES-GCM and Camelia\n      ciphers. These can be selected by their tags:\n\n          o rsa_aes_128_sha256\n          o rsa_aes_128_gcm_sha\n          o rsa_aes_256_sha256\n          o rsa_camellia_128_sha\n          o rsa_camellia_256_sha\n          o ecdh_ecdsa_aes_128_gcm_sha\n          o ecdhe_ecdsa_aes_128_sha256\n          o ecdhe_ecdsa_aes_128_gcm_sha\n          o ecdh_rsa_aes_128_gcm_sha\n          o ecdhe_rsa_aes_128_sha256\n    * \n\n      The mod_nss.conf.in template was updated to include those ciphers.\n      (bnc#863035)\n\n    * \n\n      VirtualHost settings in /etc/apache2/conf.d/mod_nss.conf is now\n      externalized to /etc/apache2/vhosts.d/vhost-nss.template and not\n      activated/read by default. (bnc#878681)\n\n    * \n\n      The Server Name Indication (SNI) extension was implemented.\n\n    * \n\n      Reading the pass phrase during start-up was improved. (bnc#863518)\n\n","status":"published","published":"2014-08-22T11:39:07Z","modified":"2026-02-04T02:49:54.397269Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2016:2285-1","title":"Security update for apache2-mod_nss","description":"\nThis update provides apache2-mod_nss 1.0.14, which brings several fixes and\nenhancements:\n\n- Fix OpenSSL ciphers stopped parsing at +. (CVE-2016-3099)\n- Created valgrind suppression files to ease debugging.\n- Implement SSL_PPTYPE_FILTER to call executables to get the key password pins.\n- Improvements to migrate.pl.\n- Update default ciphers to something more modern and secure.\n- Check for host and netstat commands in gencert before trying to use them.\n- Add server support for DHE ciphers.\n- Extract SAN from server/client certificates into env\n- Fix memory leaks and other coding issues caught by clang analyzer.\n- Add support for Server Name Indication (SNI).\n- Add support for SNI for reverse proxy connections.\n- Add RenegBufferSize? option.\n- Add support for TLS Session Tickets (RFC 5077).\n- Fix logical AND support in OpenSSL cipher compatibility.\n- Correctly handle disabled ciphers. (CVE-2015-5244)\n- Implement a slew more OpenSSL cipher macros.\n- Fix a number of illegal memory accesses and memory leaks.\n- Support for SHA384 ciphers if they are available in NSS.\n- Add compatibility for mod_ssl-style cipher definitions.\n- Add TLSv1.2-specific ciphers.\n- Completely remove support for SSLv2.\n- Add support for sqlite NSS databases.\n- Compare subject CN and VS hostname during server start up.\n- Add support for enabling TLS v1.2.\n- Don't enable SSL 3 by default. (CVE-2014-3566)\n- Fix CVE-2013-4566.\n- Move nss_pcache to /usr/libexec.\n- Support httpd 2.4+.\n- Use apache2-systemd-ask-pass to prompt for a certificate passphrase.\n  (bsc#972968, bsc#975394)\n","status":"published","published":"2016-09-10T10:52:38Z","modified":"2025-05-02T04:03:59.36217Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:2329-1","title":"Security update for apache2-mod_nss","description":"\nThis update provides apache2-mod_nss 1.0.14, which brings several fixes and\nenhancements:\n\n- SHA256 cipher names change spelling from *_sha256 to *_sha_256.\n- Drop mod_nss_migrate.pl and use upstream migrate script instead.\n- Check for Apache user owner/group read permissions of NSS database at startup.\n- Update default ciphers to something more modern and secure.\n- Check for host and netstat commands in gencert before trying to use them.\n- Don't ignore NSSProtocol when NSSFIPS is enabled.\n- Use proper shell syntax to avoid creating /0 in gencert.\n- Add server support for DHE ciphers.\n- Extract SAN from server/client certificates into env.\n- Fix memory leaks and other coding issues caught by clang analyzer.\n- Add support for Server Name Indication (SNI)\n- Add support for SNI for reverse proxy connections.\n- Add RenegBufferSize? option.\n- Add support for TLS Session Tickets (RFC 5077).\n- Implement a slew more OpenSSL cipher macros.\n- Fix a number of illegal memory accesses and memory leaks.\n- Support for SHA384 ciphers if they are available in the version of NSS mod_nss is built against.\n- Add the SECURE_RENEG environment variable.\n- Add some hints when NSS database cannot be initialized.\n- Code cleanup including trailing whitespace and compiler warnings.\n- Modernize autotools configuration slightly, add config.h.\n- Add small test suite for SNI.\n- Add compatibility for mod_ssl-style cipher definitions.\n- Add Camelia ciphers.\n- Remove Fortezza ciphers.\n- Add TLSv1.2-specific ciphers.\n- Initialize cipher list when re-negotiating handshake.\n- Completely remove support for SSLv2.\n- Add support for sqlite NSS databases.\n- Compare subject CN and VS hostname during server start up.\n- Add support for enabling TLS v1.2.\n- Don't enable SSL 3 by default. (CVE-2014-3566)\n- Improve protocol testing.\n- Add nss_pcache man page.\n- Fix argument handling in nss_pcache.\n- Support httpd 2.4+.\n- Allow users to configure a helper to ask for certificate passphrases via\n  NSSPassPhraseDialog. (bsc#975394)\n","status":"published","published":"2016-09-16T15:19:20Z","modified":"2026-02-04T04:05:55.600811Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:2396-1","title":"Security update for apache2-mod_nss","description":"\nThis update provides apache2-mod_nss 1.0.14, which brings several fixes and\nenhancements:\n\n- Fix OpenSSL ciphers stopped parsing at +. (CVE-2016-3099)\n- Created valgrind suppression files to ease debugging.\n- Implement SSL_PPTYPE_FILTER to call executables to get the key password pins.\n- Improvements to migrate.pl.\n- Update default ciphers to something more modern and secure.\n- Check for host and netstat commands in gencert before trying to use them.\n- Add server support for DHE ciphers.\n- Extract SAN from server/client certificates into env\n- Fix memory leaks and other coding issues caught by clang analyzer.\n- Add support for Server Name Indication (SNI).\n- Add support for SNI for reverse proxy connections.\n- Add RenegBufferSize? option.\n- Add support for TLS Session Tickets (RFC 5077).\n- Fix logical AND support in OpenSSL cipher compatibility.\n- Correctly handle disabled ciphers. (CVE-2015-5244)\n- Implement a slew more OpenSSL cipher macros.\n- Fix a number of illegal memory accesses and memory leaks.\n- Support for SHA384 ciphers if they are available in NSS.\n- Add compatibility for mod_ssl-style cipher definitions.\n- Add TLSv1.2-specific ciphers.\n- Completely remove support for SSLv2.\n- Add support for sqlite NSS databases.\n- Compare subject CN and VS hostname during server start up.\n- Add support for enabling TLS v1.2.\n- Don't enable SSL 3 by default. (CVE-2014-3566)\n- Fix CVE-2013-4566.\n- Move nss_pcache to /usr/libexec.\n- Support httpd 2.4+.\n- SHA256 cipher names change spelling from *_sha256 to *_sha_256.\n- Use apache2-systemd-ask-pass to prompt for a certificate passphrase.\n  (bsc#972968, bsc#975394)\n","status":"published","published":"2016-09-27T13:12:22Z","modified":"2026-02-04T03:13:59.192251Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"UBUNTU-CVE-2013-4566","description":"mod_nss 1.0.8 and earlier, when NSSVerifyClient is set to none for the server/vhost context, does not enforce the NSSVerifyClient setting in the directory context, which allows remote attackers to bypass intended access restrictions.","status":"published","published":"2013-12-12T18:55:00Z","modified":"2025-10-24T04:45:03Z","updated_at":"2026-11-02T15:54:07.421078Z"}]}}