Improper Access Control Affecting apache2 package, versions <2.4.23-1

Q: How to fix?

Upgrade Debian:10 apache2 to version 2.4.23-1 or higher.

Threat Intelligence

0.21% (60^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Improper Access Control vulnerabilities in an interactive lesson.

Start learning

Snyk IDSNYK-DEBIAN10-APACHE2-391772
published6 Jul 2016
disclosed6 Jul 2016

Report a new vulnerability Found a mistake?

Introduced: 6 Jul 2016

CVE-2016-4979 (opens in a new tab) CWE-284 (opens in a new tab)

How to fix?

Upgrade Debian:10 apache2 to version 2.4.23-1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream apache2 package and not the apache2 package as distributed by Debian. See How to fix? for Debian:10 relevant fixed versions and status.

The Apache HTTP Server 2.4.18 through 2.4.20, when mod_http2 and mod_ssl are enabled, does not properly recognize the "SSLVerifyClient require" directive for HTTP/2 request authorization, which allows remote attackers to bypass intended access restrictions by leveraging the ability to send multiple requests over a single connection and aborting a renegotiation.