Summary
[2.4.6-99.0.9.1]
- Fix CVE-2025-58098 [Orabug: 38816066]
[2.4.6-99.0.7.1]
- Fixed security update CVE-2024-47252 CVE-2025-49812 [Orabug: 38378160]
[2.4.6-99.0.5.1]
- Differentiate trusted sources [Orabug: 37100272][CVE-2024-38476]
[2.4.6-99.0.3.1]
- Opt-ins for unsafe prefix_stat and %3f [Orabug: 36904263][CVE-2024-38474][CVE-2024-38475]
- mod_proxy: validate hostname [Orabug: 36904263][CVE-2024-38477]
[2.4.6-99.1.0.1]
- mod_proxy: ap_proxy_http_request() to clear hop-by-hop first and
fixup last [CVE-2022-31813][Orabug: 34381850]
- mod_session: save one apr_strtok() [Orabug: 33338149][CVE-2021-26690]
- replace index.html with Oracle's index page oracle_index.html
[2.4.6-99.1]
- Resolves: #2190143 - mod_rewrite regression with CVE-2023-25690
[2.4.6-97.7]
- Resolves: #2177742 - CVE-2023-25690 httpd: HTTP request splitting with
mod_rewrite and mod_proxy
[2.4.6-97.6]
- Resolves: #2101997 - HEAD request with a 404 and custom ErrorPage causes
corrupt and mixed-up responses
[2.4.6-97.5]
- Resolves: #2065243 - CVE-2022-22720 httpd: HTTP request smuggling
vulnerability in Apache HTTP Server 2.4.52 and earlier
[2.4.6-97.4]
- Resolves: #2031072 - CVE-2021-34798 httpd: NULL pointer dereference via
malformed requests
- Resolves: #2031074 - CVE-2021-39275 httpd: out-of-bounds write in
ap_escape_quotes() via malicious input
- Resolves: #1969226 - CVE-2021-26691 httpd: Heap overflow in mod_session
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | httpd | 0:2.4.6-99.0.9.el7_9.1 |
| Oracle Linux · 7 | httpd-devel | 0:2.4.6-99.0.9.el7_9.1 |
| Oracle Linux · 7 | httpd-manual | 0:2.4.6-99.0.9.el7_9.1 |
| Oracle Linux · 7 | httpd-tools | 0:2.4.6-99.0.9.el7_9.1 |
| Oracle Linux · 7 | mod_ldap | 0:2.4.6-99.0.9.el7_9.1 |
| Oracle Linux · 7 | mod_proxy_html | 1:2.4.6-99.0.9.el7_9.1 |
| Oracle Linux · 7 | mod_session | 0:2.4.6-99.0.9.el7_9.1 |
| Oracle Linux · 7 | mod_ssl | 1:2.4.6-99.0.9.el7_9.1 |
Vulnerabilities 1
-
High 8.3CVE-2025-58098 Public exploit
Apache HTTP Server: Server Side Includes adds query string to #exec cmd=...
Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives. This issue affects Apache HTTP Server before 2.4.66. Users are recommended to upg…