Red Hat Security AdvisoryRHSA-2025:23919
httpd security update
Released 2025-12-22 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) httpd-2.4.62-7.el9_7.3, httpd-core-2.4.62-7.el9_7.3, httpd-devel-2.4.62-7.el9_7.3 +8
Fixes 3 records
Priority MEDIUM 41
Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives.
CVSS 3.1HIGH 8.3· Network · Low privileges · No interaction · EPSS 0.01526 · Published 2025-12-05 · Fixed in 2.4.66 CWE-201
Priority LOW 30
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server…
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00865 · Published 2025-12-05 · Partial fix CWE-150
Priority LOW 26
mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00697 · Published 2025-12-05 · Partial fix CWE-288
