Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-54090: A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true". Users are recommended to upgrade to version 2.4.65, which fixes the issue.
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | httpd | 0:2.4.65-1.amzn2.0.2 |
| Amazon Linux · 2 | httpd-debuginfo | 0:2.4.65-1.amzn2.0.2 |
| Amazon Linux · 2 | httpd-devel | 0:2.4.65-1.amzn2.0.2 |
| Amazon Linux · 2 | httpd-filesystem | 0:2.4.65-1.amzn2.0.2 |
| Amazon Linux · 2 | httpd-manual | 0:2.4.65-1.amzn2.0.2 |
| Amazon Linux · 2 | httpd-tools | 0:2.4.65-1.amzn2.0.2 |
| Amazon Linux · 2 | mod_ldap | 0:2.4.65-1.amzn2.0.2 |
| Amazon Linux · 2 | mod_md | 0:2.4.65-1.amzn2.0.2 |
| Amazon Linux · 2 | mod_proxy_html | 1:2.4.65-1.amzn2.0.2 |
| Amazon Linux · 2 | mod_session | 0:2.4.65-1.amzn2.0.2 |
| Amazon Linux · 2 | mod_ssl | 1:2.4.65-1.amzn2.0.2 |
Vulnerabilities 1
-
Medium 6.3
Apache HTTP Server: 'RewriteCond expr' always evaluates to true in 2.4.64
A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true". Users are recommended to upgrade to version 2.4.65, which fixes the issue.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2025-54090.html