Red Hat Security Advisory: Red Hat Hardened Images RPM Release

Fixed packages 6

Vulnerabilities 4

• High 8.3
  CVE-2025-58098 Public exploit

  Apache HTTP Server: Server Side Includes adds query string to #exec cmd=...

  Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives. This issue affects Apache HTTP Server before 2.4.66. Users are recommended to upg…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Dec 5, 2025
• High 7.5
  CVE-2025-59775

  Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF

  Server-Side Request Forgery (SSRF) vulnerability  in Apache HTTP Server on Windows with AllowEncodedSlashes On and MergeSlashes Off  allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended …

  Apache Software Foundation Apache HTTP Server apache2 Alpine
  Dec 5, 2025
• Medium 6.5
  CVE-2025-65082

  Apache HTTP Server: CGI environment variable override

  Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs. This issue affects A…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Dec 5, 2025
• Medium 5.4
  CVE-2025-66200

  Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo

  mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid. This issue affects Apache HTTP Server: fro…

  Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  Dec 5, 2025

References

• report
  https://access.redhat.com/security/cve/CVE-2025-58098
• article
  https://access.redhat.com/security/updates/classification/
• report
  https://access.redhat.com/security/cve/CVE-2025-66200
• report
  https://access.redhat.com/security/cve/CVE-2025-59775
• report
  https://access.redhat.com/security/cve/CVE-2025-65082
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_5156.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419365
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-58098
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-58098
• article
  https://httpd.apache.org/security/vulnerabilities_24.html
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419141
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-59775
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-59775
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419139
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-65082
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-65082
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419262
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-66200
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-66200
• article
  http://www.openwall.com/lists/oss-security/2025/12/04/8