A security issue has been reported in mod_ssl, which potentially can be exploited by malicious people to bypass certain security restrictions.

The security issue is caused due to an error in enforcing client-based certificate authentication ("SSLVerifyClient require") in per-location context, if "SSLVerifyClient optional" was configured in the global virtual host configuration. This may allow malicious people to bypass client-based certificate authentication and gain unauthorised access to certain web pages.

Solution
mod_ssl 2.x:
Further details available to Secunia VIM customers

Provided and/or discovered by
Reported by vendor.

Changelog
Further details available to Secunia VIM customers

Original Advisory
Apache.org:
http://www.apache.org/dist/httpd/Announcement2.0.html

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers