Red Hat Security AdvisoryRHSA-2025:14997
httpd security update
Released 2025-09-02 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Server (v. 7 ELS) httpd-2.4.6-99.el7_9.6, httpd-devel-2.4.6-99.el7_9.6, httpd-manual-2.4.6-99.el7_9.6 +3
- Red Hat Enterprise Linux Server Optional (v. 7 ELS) mod_ldap-2.4.6-99.el7_9.6, mod_proxy_html-1:2.4.6-99.el7_9.6
Fixes 2 records
Priority MEDIUM 40
Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00795 · Published 2025-07-10 · Partial fix CWE-150
Priority LOW 35
In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.00614 · Published 2025-07-10 · Fixed CWE-287
