Summary
[2.4.6-99.0.7.1]
- Fixed security update CVE-2024-47252 CVE-2025-49812 [Orabug: 38378160]
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | httpd | 0:2.4.6-99.0.7.el7_9.1 |
| Oracle Linux · 7 | httpd-devel | 0:2.4.6-99.0.7.el7_9.1 |
| Oracle Linux · 7 | httpd-manual | 0:2.4.6-99.0.7.el7_9.1 |
| Oracle Linux · 7 | httpd-tools | 0:2.4.6-99.0.7.el7_9.1 |
| Oracle Linux · 7 | mod_ldap | 0:2.4.6-99.0.7.el7_9.1 |
| Oracle Linux · 7 | mod_proxy_html | 1:2.4.6-99.0.7.el7_9.1 |
| Oracle Linux · 7 | mod_session | 0:2.4.6-99.0.7.el7_9.1 |
| Oracle Linux · 7 | mod_ssl | 1:2.4.6-99.0.7.el7_9.1 |
Vulnerabilities 2
-
High 7.5
Apache HTTP Server: mod_ssl error log variable escaping
Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%{va…
-
High 7.4CVE-2025-49812 Public exploit
Apache HTTP Server: mod_ssl TLS upgrade attack
In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using "SSLEngine optional" to enable TLS upg…