Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP3 security update

Fixed packages 88

Vulnerabilities 6

• Critical 9.8
  CVE-2025-9230

  Out-of-bounds read & write in RFC 3211 KEK Unwrap

  Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Sep 30, 2025
• High 8.3
  CVE-2025-58098 Public exploit

  Apache HTTP Server: Server Side Includes adds query string to #exec cmd=...

  Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives. This issue affects Apache HTTP Server before 2.4.66. Users are recommended to upg…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Dec 5, 2025
• High 7.5
  CVE-2025-55753

  Apache HTTP Server: mod_md (ACME), unintended retry intervals

  An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backoff timer becoming 0. Attempts to renew the certificate then are repeated without delays until it succeeds. T…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Dec 5, 2025
• High 7.4
  CVE-2025-69419 Public exploit

  Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion

  Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before the allocated buffer. Impact summary: The out-of-…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  Jan 27, 2026
• Medium 6.5
  CVE-2025-65082

  Apache HTTP Server: CGI environment variable override

  Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs. This issue affects A…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Dec 5, 2025
• Medium 5.4
  CVE-2025-66200

  Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo

  mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid. This issue affects Apache HTTP Server: fro…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Dec 5, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.redhat.com/en/documentation/red_hat_jboss_core_services/2.4.62/html/red_hat_jboss_core_services_apache_http_server_2.4.62_service_pack_3_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2396054
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419139
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419140
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419262
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419365
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2430386
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2994.json
• report
  https://access.redhat.com/security/cve/CVE-2025-9230
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-9230
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-9230
• report
  https://access.redhat.com/security/cve/CVE-2025-55753
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-55753
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-55753
• article
  https://httpd.apache.org/security/vulnerabilities_24.html
• report
  https://access.redhat.com/security/cve/CVE-2025-58098
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-58098
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-58098
• report
  https://access.redhat.com/security/cve/CVE-2025-65082
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-65082
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-65082
• report
  https://access.redhat.com/security/cve/CVE-2025-66200
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-66200
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-66200
• article
  http://www.openwall.com/lists/oss-security/2025/12/04/8
• report
  https://access.redhat.com/security/cve/CVE-2025-69419
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-69419
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-69419