Synopsis:          Moderate: mod_nss security update
Advisory ID:       SLSA-2013:1779-1
Issue Date:        2013-12-03
CVE Numbers:       CVE-2013-4566
--

A flaw was found in the way mod_nss handled the NSSVerifyClient setting
for the per-directory context. When configured to not require a client
certificate for the initial connection and only require it for a specific
directory, mod_nss failed to enforce this requirement and allowed a client
to access the directory when no valid client certificate was provided.
(CVE-2013-4566)

The httpd service must be restarted for this update to take effect.
--

SL5
  x86_64
    mod_nss-1.0.8-8.el5_10.x86_64.rpm
    mod_nss-debuginfo-1.0.8-8.el5_10.x86_64.rpm
  i386
    mod_nss-1.0.8-8.el5_10.i386.rpm
    mod_nss-debuginfo-1.0.8-8.el5_10.i386.rpm
SL6
  x86_64
    mod_nss-1.0.8-19.el6_5.x86_64.rpm
    mod_nss-debuginfo-1.0.8-19.el6_5.x86_64.rpm
  i386
    mod_nss-1.0.8-19.el6_5.i686.rpm
    mod_nss-debuginfo-1.0.8-19.el6_5.i686.rpm

- Scientific Linux Development Team