CVE-2019-0215

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.37 through 2.4.38

Description The issue is related to a flaw in the mod ssl component of the Apache HTTP Server, specifically concerning inadequate access control. This flaw can be exploited by a remote attacker to bypass configured access control restrictions when client certificate verification is used with TLSv1.3. The attack can be launched remotely.

Recommendations For versions 2.4.37 and 2.4.38, consider disabling the use of TLSv1.3 with client certificate verification until a patch is available. As a temporary workaround, restrict access to locations using per-location client certificate verification to minimize the risk of exploitation.