Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Apache-SSL 1.3.28+1.52 and earlier, with SSLVerifyClient set to 1 or 3 and SSLFakeBasicAuth enabled, allows remote attackers to forge a client certificate by using basic authentication with the "one-line DN" of the target user.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Apache-SSL客户端程序伪造漏洞
Vulnerability Description
Apache是一款开放源代码WEB服务程序，其中可通过SSL对通信进行加密。 Apache-SSL在部分配置情况下存在问题，远程攻击者可以利用这个漏洞伪造客户端证书进行认证。 如果把SSLVerifyClient设置为1或3(客户端证书可选)及SSLFakeBasicAuth，Apache-SSL 1.3.28+1.52及之前版本允许客户端使用实际BASIC验证来伪造客户端证书。 所有攻击者需要一个合法用户的"one-line DN"，用于在Apache-SSL伪造BASIC AUTH，和一个固定的密码(
CVSS Information
N/A
Vulnerability Type
N/A