CVE-2016-4979

Publication date 6 July 2016

Last updated 25 August 2025

Ubuntu priority

Cvss 3 Severity Score

Description

The Apache HTTP Server 2.4.18 through 2.4.20, when mod_http2 and mod_ssl are enabled, does not properly recognize the "SSLVerifyClient require" directive for HTTP/2 request authorization, which allows remote attackers to bypass intended access restrictions by leveraging the ability to send multiple requests over a single connection and aborting a renegotiation.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
apache2	16.04 LTS xenial	Not affected
	15.10 wily	Not affected
	14.04 LTS trusty	Not affected
	12.04 LTS precise	Not affected

Notes

mdeslaur

advisory says introduced in 2.4.18 xenial package not built with mod_http2 support

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
apache2	Upstream: https://svn.apache.org/r1750779

Severity score breakdown

Parameter	Value
Base score	7.5 · High
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	High
Availability impact	None
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N