Updated mod_ssl packages for Red Hat Linux 7, 7.1, and 7.2 are available which close a buffer overflow in mod_ssl.
When session caching is enabled, mod_ssl will serialize SSL session variables to store them for later use. Unpatched versions of mod_ssl prior to version 2.8.7 which use the 'shm' or 'dbm' session caches would store session variables using a buffer with a fixed size, making it vulnerable to overflow. To exploit the overflow, the server must be configured to require client certificates, and an attacker must obtain a carefully crafted client certificate that has been signed by a Certificate Authority which is trusted by the server. If these conditions are met, it would be possible for an attacker to execute arbitrary code on the server. Red Hat Linux 6.2 and earlier releases which did not include the mod_ssl package are not vulnerable to this bug. Users who utilize client certificate authentication are strongly advised to upgrade or switch to shared memory session cache, shmcb, which is not vulnerable to this issue. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-0082 to this issue.