Apache 2 before 2.0.47, and certain versions of mod_ssl for Apache 1.3, do not properly handle certain sequences of per-directory renegotiations and the SSLCipherSuite directive being used to upgrade from a weak ciphersuite to a strong one, which could cause Apache to use the weak ciphersuite.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Http_server | Apache | 2.0 (including) | 2.0 (including) |
| Http_server | Apache | 2.0.28 (including) | 2.0.28 (including) |
| Http_server | Apache | 2.0.32 (including) | 2.0.32 (including) |
| Http_server | Apache | 2.0.35 (including) | 2.0.35 (including) |
| Http_server | Apache | 2.0.36 (including) | 2.0.36 (including) |
| Http_server | Apache | 2.0.37 (including) | 2.0.37 (including) |
| Http_server | Apache | 2.0.38 (including) | 2.0.38 (including) |
| Http_server | Apache | 2.0.39 (including) | 2.0.39 (including) |
| Http_server | Apache | 2.0.40 (including) | 2.0.40 (including) |
| Http_server | Apache | 2.0.41 (including) | 2.0.41 (including) |
| Http_server | Apache | 2.0.42 (including) | 2.0.42 (including) |
| Http_server | Apache | 2.0.43 (including) | 2.0.43 (including) |
| Http_server | Apache | 2.0.44 (including) | 2.0.44 (including) |
| Http_server | Apache | 2.0.45 (including) | 2.0.45 (including) |
| Http_server | Apache | 2.0.46 (including) | 2.0.46 (including) |
| Red Hat Enterprise Linux AS (Advanced Server) version 2.1 | RedHat | * | |
| Red Hat Enterprise Linux ES version 2.1 | RedHat | * | |
| Red Hat Enterprise Linux WS version 2.1 | RedHat | * | |
| Red Hat Linux 7.1 | RedHat | * | |
| Red Hat Linux 7.2 | RedHat | * | |
| Red Hat Linux 7.3 | RedHat | * | |
| Red Hat Linux 8.0 | RedHat | * | |
| Red Hat Linux 9 | RedHat | * | |
| Red Hat Linux Advanced Workstation 2.1 | RedHat | * | |
| Red Hat Stronghold 4 | RedHat | * | |
| Stronghold 4 for Red Hat Enterprise Linux | RedHat | * |