IBM HTTP Server Remote Code Execution and Denial-of-Service Vulnerability in TLS Mutual Authentication Configurations

A vulnerability in IBM HTTP Server versions 8.5 and 9.0 allows for remote code execution and denial-of-service conditions, specifically in configurations that utilize TLS mutual authentication (client authentication).

Impact

Exploitation of this vulnerability could lead to unauthorized remote code execution on the server or cause a denial-of-service condition, disrupting normal server operations.

Remediation

Users are advised to upgrade to IBM HTTP Server Fix Pack 9.0.5.29 or later, or Fix Pack 8.5.5.30 or later. For both versions, additional interim fixes may be available and linked off the interim fix download page.