Fixed packages 20
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 9 enterprise_linux:9::appstream | httpd | 0:2.4.62-7.el9_7.3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | httpd-core | 0:2.4.62-7.el9_7.3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | httpd-core-debuginfo | 0:2.4.62-7.el9_7.3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | httpd-debuginfo | 0:2.4.62-7.el9_7.3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | httpd-debugsource | 0:2.4.62-7.el9_7.3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | httpd-devel | 0:2.4.62-7.el9_7.3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | httpd-filesystem | 0:2.4.62-7.el9_7.3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | httpd-manual | 0:2.4.62-7.el9_7.3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | httpd-tools | 0:2.4.62-7.el9_7.3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | httpd-tools-debuginfo | 0:2.4.62-7.el9_7.3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | mod_ldap | 0:2.4.62-7.el9_7.3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | mod_ldap-debuginfo | 0:2.4.62-7.el9_7.3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | mod_lua | 0:2.4.62-7.el9_7.3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | mod_lua-debuginfo | 0:2.4.62-7.el9_7.3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | mod_proxy_html | 1:2.4.62-7.el9_7.3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | mod_proxy_html-debuginfo | 1:2.4.62-7.el9_7.3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | mod_session | 0:2.4.62-7.el9_7.3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | mod_session-debuginfo | 0:2.4.62-7.el9_7.3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | mod_ssl | 1:2.4.62-7.el9_7.3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | mod_ssl-debuginfo | 1:2.4.62-7.el9_7.3 |
Vulnerabilities 3
-
High 8.3CVE-2025-58098 Public exploit
Apache HTTP Server: Server Side Includes adds query string to #exec cmd=...
Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives. This issue affects Apache HTTP Server before 2.4.66. Users are recommended to upg…
-
Medium 6.5
Apache HTTP Server: CGI environment variable override
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs. This issue affects A…
-
Medium 5.4
Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo
mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid. This issue affects Apache HTTP Server: fro…
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2419139
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2419262
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2419365
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23919.json
-
report
https://access.redhat.com/security/cve/CVE-2025-58098
-
advisory
https://www.cve.org/CVERecord?id=CVE-2025-58098
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-58098
-
article
https://httpd.apache.org/security/vulnerabilities_24.html
-
report
https://access.redhat.com/security/cve/CVE-2025-65082
-
advisory
https://www.cve.org/CVERecord?id=CVE-2025-65082
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-65082
-
report
https://access.redhat.com/security/cve/CVE-2025-66200
-
advisory
https://www.cve.org/CVERecord?id=CVE-2025-66200
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-66200
-
article
http://www.openwall.com/lists/oss-security/2025/12/04/8