CVE-2002-0082: apache-ssl
Vulnerability summary
CVE-2002-0082 is a high (CVSS 7.5) vulnerability in apache-ssl. EPSS estimates a 29.66% chance of exploitation in the next 30 days, higher than 98.1% of scored vulnerabilities. 3 public exploits are recorded.
Timeline
- 25-06-2002PublishedVulnerability first disclosed.
- 08-08-2024Last modifiedVulnerability information updated.
Description
The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before 1.3.22+1.46, does not properly initialize memory using the i2d_SSL_SESSION function, which allows remote attackers to use a buffer overflow to execute arbitrary code via a large client certificate that is signed by a trusted Certificate Authority (CA), which produces a large serialized session.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
29.66%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
0.00 pp
From 29.66% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundApache mod_ssl < 2.8.7 OpenSSL - 'OpenFuck.c' Remote Buffer Overflow
Maturity: weaponized
Apache mod_ssl < 2.8.7 OpenSSL - 'OpenFuckV2.c' Remote Buffer Overflow (1)
Maturity: weaponized
Apache mod_ssl < 2.8.7 OpenSSL - 'OpenFuckV2.c' Remote Buffer Overflow (2)
Maturity: poc
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Apache-ssl1 product
- apache-ssl1.40 | 1.41 | 1.42 | 1.44 | 1.45 | 1.46
Mod_ssl1 product
- mod_ssl2.7.1 | 2.8 | 2.8.1 | 2.8.2 | 2.8.3 | 2.8.4 | 2.8.5 | 2.8.6
2 vendors · 2 products
References
18 links- www.calderasystems.com/support/security/advisories/CSSA-2002-011.0.txtVendor AdvisoryX Refsource CALDERA
Show all 18 references
- www.apacheweek.com/issues/02-03-01X Refsource CONFIRM
