Summary
USN-7639-1 fixed several vulnerabilities in Apache. This update
provides the corresponding update for Ubuntu 16.04 LTS, Ubuntu
18.04 LTS, Ubuntu 20.04 LTS, and addressed a regression
fix (LP: #2119395). CVE-2025-49630 and CVE-2025-53020 only
affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that the Apache HTTP Server incorrectly handled
certain Content-Type response headers. A remote attacker could
possibly use this issue to perform HTTP response splitting attacks.
(CVE-2024-42516)
xiaojunjie discovered that the Apache HTTP Server mod_proxy module
incorrectly handled certain requests. A remote attacker could
possibly use this issue to send outbound proxy requests to an
arbitrary URL. (CVE-2024-43204)
John Runyon discovered that the Apache HTTP Server mod_ssl module
incorrectly escaped certain data. A remote attacker could possibly
use this issue to insert escape characters into log files.
(CVE-2024-47252)
Sven Hebrok, Felix Cramer, Tim Storm, Maximilian Radoy, and Juraj
Somorovsky discovered that the Apache HTTP Server mod_ssl module
incorrectly handled TLS 1.3 session resumption. A remote attacker
could possibly use this issue to bypass access control. (CVE-2025-23048)
Anthony CORSIEZ discovered that the Apache HTTP Server mod_proxy_http2
module incorrectly handled missing host headers. A remote attacker
could possibly use this issue to cause the server to crash, resulting
in a denial of service. (CVE-2025-49630)
Robert Merget discovered that the Apache HTTP Server mod_ssl module
incorrectly handled TLS upgrades. A remote attacker could possibly
use this issue to hijack an HTTP session. This update removes the
old "SSLEngine optional" configuration option, possibly requiring
a configuration change in certain environments. (CVE-2025-49812)
Gal Bar Nahum discovered that the Apache HTTP Server incorrectly
handled certain memory operations. A remote attacker could possibly
use this issue to cause the server to consume resources, leading
to a denial of service. (CVE-2025-53020)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | apache2 | 2.4.18-2ubuntu3.17+esm16 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | apache2 | 2.4.29-1ubuntu4.27+esm6 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | apache2 | 2.4.41-4ubuntu3.23+esm2 |
Vulnerabilities 7
-
Critical 9.1CVE-2025-23048 Public exploit
Apache HTTP Server: mod_ssl access control bypass with session resumption
In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption. Configurations are affected when mod_ssl is configured for multiple virtual hosts, with ea…
-
High 7.5
Apache HTTP Server: HTTP response splitting
HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response. This vulnerability was described as CVE-2023-38709 b…
-
High 7.5
Apache HTTP Server: SSRF with mod_headers setting Content-Type header
SSRF in Apache HTTP Server with mod_proxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker. Requires an unlikely configuration where mod_headers is configured to modify the Content-Type request or response header …
-
High 7.5
Apache HTTP Server: mod_ssl error log variable escaping
Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%{va…
-
High 7.5
Apache HTTP Server: mod_proxy_http2 denial of service
In certain proxy configurations, a denial of service attack against Apache HTTP Server versions 2.4.26 through to 2.4.63 can be triggered by untrusted clients causing an assertion in mod_proxy_http2. Configurations affected are a reverse proxy is configured f…
-
High 7.5CVE-2025-53020 Public exploit
Apache HTTP Server: HTTP/2 DoS by Memory Increase
Late Release of Memory after Effective Lifetime vulnerability in Apache HTTP Server. This issue affects Apache HTTP Server: from 2.4.17 up to 2.4.63. Users are recommended to upgrade to version 2.4.64, which fixes the issue.
-
High 7.4CVE-2025-49812 Public exploit
Apache HTTP Server: mod_ssl TLS upgrade attack
In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using "SSLEngine optional" to enable TLS upg…
References
-
report
https://ubuntu.com/security/CVE-2024-42516
-
report
https://ubuntu.com/security/CVE-2024-43204
-
report
https://ubuntu.com/security/CVE-2024-47252
-
report
https://ubuntu.com/security/CVE-2025-23048
-
report
https://ubuntu.com/security/CVE-2025-49630
-
report
https://ubuntu.com/security/CVE-2025-49812
-
report
https://ubuntu.com/security/CVE-2025-53020
-
report
https://launchpad.net/bugs/2119395