Apache HTTP Server could allow a remote attacker to gain access to client certificates caused by a vulnerability in the modules/ssl/ssl_engine_kernel.c. If the virtual host has been programmed with the SSLVerifyClient Optional directive, the ssl_hook_access() function fails to properly validate the SSLVerifyClient Require directive in a per-location context. A remote attacker could use this vulnerability to gain unauthorized access to the Secure Socket Layer (SSL) client certificates within a specific configuration.
Denotes that component is vulnerable