Secunia

Hartmut Keil has reported a security issue in Apache2, which can be exploited by malicious people to bypass certain security restrictions.

The problem is that a client can access a location using any cipher suite allowed by the virtual host configuration even though access to that location has been configured to require a specific set of cipher suites.

Successful exploitation requires that the mod_ssl module has been configured with the "SSLCipherSuite" directive in directory or location context.

The security issue affects versions 2.0.35 through 2.0.52.

Solution
Update to version 2.0.53.
Further details available in Customer Area

Provided and/or discovered by
Hartmut Keil

Changelog
Further details available in Customer Area

Original Advisory
http://issues.apache.org/bugzilla/show_bug.cgi?id=31505

Deep Links
Links available in Customer Area