Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP1 security update

Fixed packages 47

Vulnerabilities 5

• Critical 9.1
  CVE-2025-23048 Public exploit

  Apache HTTP Server: mod_ssl access control bypass with session resumption

  In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption. Configurations are affected when mod_ssl is configured for multiple virtual hosts, with ea…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jul 10, 2025
• High 7.5
  CVE-2024-47252

  Apache HTTP Server: mod_ssl error log variable escaping

  Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%{va…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jul 10, 2025
• High 7.5
  CVE-2025-47947 Public exploit

  ModSecurity Has Possible DoS Vulnerability

  ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Versions up to and including 2.9.8 are vulnerable to denial of service in one special case (in stable released versions): when the payload's content…

  owasp-modsecurity ModSecurity modsecurity-apache mod_security Debian Ubuntu Azure Linux
  May 21, 2025
• High 7.5
  CVE-2025-49630

  Apache HTTP Server: mod_proxy_http2 denial of service

  In certain proxy configurations, a denial of service attack against Apache HTTP Server versions 2.4.26 through to 2.4.63 can be triggered by untrusted clients causing an assertion in mod_proxy_http2. Configurations affected are a reverse proxy is configured f…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jul 10, 2025
• High 7.4
  CVE-2025-49812 Public exploit

  Apache HTTP Server: mod_ssl TLS upgrade attack

  In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using "SSLEngine optional" to enable TLS upg…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Jul 10, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_core_services/2.4.62/html/red_hat_jboss_core_services_apache_http_server_2.4.62_service_pack_1_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2367903
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2374571
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2374576
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2374578
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2374580
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_13680.json
• report
  https://access.redhat.com/security/cve/CVE-2024-47252
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-47252
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-47252
• article
  https://httpd.apache.org/security/vulnerabilities_24.html
• report
  https://access.redhat.com/security/cve/CVE-2025-23048
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-23048
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-23048
• report
  https://access.redhat.com/security/cve/CVE-2025-47947
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-47947
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-47947
• article
  https://github.com/owasp-modsecurity/ModSecurity/pull/3389
• article
  https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-859r-vvv8-rm8r
• report
  https://access.redhat.com/security/cve/CVE-2025-49630
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-49630
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-49630
• report
  https://access.redhat.com/security/cve/CVE-2025-49812
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-49812
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-49812